Tracing Data Analytics Red Flags Back to Source Documents Using Subpoenas 5-1 ANDERSON INTERNAL MEDICINE AND LARSEN CONVENIENCE STORE (CONSPIRACY AND LOAN FRAUD): TRACE TRANSACTIONS DISCOVERED DURING DATA ANALYTICS BACK TO SOURCE DOCUMENTS USING SUBPOENAS LEARNING OBJECTIVE After completing this case, you should be able to: 1. Take red flags detected from using data analytics (i.e., suspicious deposit and related disbursements) and trace those transactions back to the source documents (loan documents in this case). 2. Ppare subpoena wording for attorneys to obtain additional bank documents. 3. Review loan documents and determine whether the loan documents (credit applications and supporting documents) contain material misstatements. HISTORY BEHIND THE FRAUD CASE Father and son were targets of an arson?for?profit investigation. The father was gambling at a casino at the time an incendiary fire destroyed his business. Data analysis of the primary business bank account detected a large deposit, which was significantly larger than any prior deposits associated with the business. Using first?in, first?out (FIFO) analysis, the recent deposit was matched with funds used to pay a casino, other financial institutions, and a construction company. A second round of subpoenas was served to the source of the large deposit and the entities that received the checks associated with the deposit. It revealed, among other things, that the large deposit was partially used for payment of construction charges in arrears. Another round of subpoenas was serviced to all of the financial institutions in the small town to locate and obtain both the father and son's personal checking accounts. Documents received from the subpoenas revealed payments for gambling debts to several casinos, a host of delinquencies on mortgages owed individually by the father, mortgages owed individually by the son, and vendors that supplied the business as well as a contractor building a commercial structure. This resulted in a fourth round of subpoenas to casinos, mortgage companies, and vendors. Of particular note, the subpoena to the contractor discovered that the proceeds of the commercial loan were not used for new construction, as requested in the credit application. In total, the loan proceeds eventually went through a This study source was downloaded by 100000768677837 from CourseHero.com on 04-20-2023 09:53:54 GMT -05:00 https://www.coursehero.com/file/22900854/Fraud-Examination-CHAPTER-5/ total of five financial institutions and were a challenge to simplify the sources and uses of loan proceeds during expert testimony. Father and son were convicted of arson and over 30 fraud counts, including loan application fraud, check kiting, and scheme to defraud a bank. The judge sentenced both to 10 years in prison. BACKGROUND As discussed in the overview of the serial cases, Greg Larsen owned and operated Larsen Convenience Store (case 1) and Tonya Larsen was the office manager for Anderson Internal Medicine (AIM) (cases 2 to 4). Often, the spouse of a fraudster is oblivious to (and innocent of) the alleged fraud(s) being examined. In other instances, the husband and wife are conspirators. Part of a fraud examination involving husband and wife is, among other things, to determine the facts between husband and wife. From cases 1 to 4 we found that Greg's cash flow problems financially impacted his wife, and vice versa. Recall that the fraud examination of the income tax returns and personal financial statements in case 1 found that Greg Larsen (DBA Larsen Convenience) had significant cash flow problems: The company's balance in its checking account significantly decreased, the company's credit card balance significantly increased, Greg laid off employees, and all of his vendors made him sign promissory notes and put all of his future shipments during the final two months on cash on delivery (COD) terms. In addition, the income tax returns show that Tonya's salary significantly decreased in 2015 (she had been terminated by her former employer and was unemployed for six months before joining AIM). In Case 4, you examined documents processed by AIM's bank between September 1, 2015, and February 29, 2016. Through Excel Pivot data analytics, you identified red flags that required additional examination that were posted by the bank in late December 2015. Of particular note, you detected a check dated December 30, 2015, for $36,000.00 that was deposited into the AIM checking account. The $36,000.00 check was made payable to "Cash" and drawn on Greg Larsen's account at Waleska Bank (Waleska, Georgia). A review of all other deposits showed cash deposits that totaled less than $2,000. Larsen Convenience Store burnt down two days later.1 In many fraud examinations, evidence is received and examined in helter? skelter order. This case is an example of discovering suspicious activity late in a fraud examination and having to double back and examine new documents. In the current case, a series of subpoenas associated with the red flags returned documents from two financial institutions (Bank of Lawrenceville and Waleska Bank) and an interview was conducted with the lending officer of Waleska Bank. This study source was downloaded by 100000768677837 from CourseHero.com on 04-20-2023 09:53:54 GMT -05:00 https://www.coursehero.com/file/22900854/Fraud-Examination-CHAPTER-5/ INNOCENT THIRD PARTIES (FINANCIAL INSTITUTIONS) Financial institutions often collect their loans or mortgages if they follow good lending policy and file a financing statement (a standard legal form that lenders file with the clerk of court to secure title to various types of non-real? estate property pledged as collateral for a loan) or a deed of trust (mortgage filing similar to financing statements that collateralize the real property). Insurance companies generally pay innocent third parties (like a financial institution) in a casualty loss if the financial institution properly secured the loans or mortgages, respectively. Although financial institutions suffer no economic loss, the insurance companies who reimburse the financial institutions suffer the loss. CONSPIRACY The federal government and the various states have criminal statutes regarding conspiracy to commit criminal acts. According to the U.S. Attorneys' Manual, Criminal Resource Manual (CRM? 923), the general conspiracy statue is 18 U.S.C.  371?Conspiracy to Defraud the United States. It defines conspiracy as: an offense [i]f two or more persons conspire either to commit any offense against the United States, or to defraud the United States, or any agency thereof in any manner or for any purpose...The operative language is the so? called "defraud clause," that prohibits conspiracies to defraud the United States. This clause creates a separate offense from the "offense clause" in Section 371. Both offenses require the traditional elements of Section 371 conspiracy, including an illegal agreement, criminal intent, and proof of an overt act. In short, a conspiracy is a verbal, written, or unspoken agreement between two or more persons to intentionally commit an apparent criminal act in furtherance of their agreement. In this fraud case, an argument can be made that Greg and Tonya conspired to obtain loan proceeds for a stated purpose; move that money through a series of federally insured bank accounts; and then disburse that money for other purposes. SUMMARY REQUIREMENTS After conferring with the attorney for Southern Appalachian Insurance Company, you ppared and he edited wording for subpoenas to the Bank of Lawrenceville and Waleska Bank to find out more information concerning the $36,000.00 check. Note: these subpoenas are not provided. Raymond T. Boone, CFE, a special agent with the insurance company's Special Investigative Unit (SIU), subsequently interviews John Grayson, the Senior Vice President and Branch Manager for Waleska Bank in Ball Ground, Georgia. This study source was downloaded by 100000768677837 from CourseHero.com on 04-20-2023 09:53:54 GMT -05:00 https://www.coursehero.com/file/22900854/Fraud-Examination-CHAPTER-5/ 1. Review the documents returned with the subpoenas and the interview of John Grayson in Chapter 7, section 7?5, "Anderson Internal Medicine and Larsen Convenience (Husband/Wife Loan Fraud and Conspiracy)." 2. Write up the fraud examination analysis for an addendum to the original fraud examination reports for both Larsen Convenience Store and Anderson Internal Medicine that discusses the results of your review. Be sure to include condition(material error or fraud discovered), criteria (description in the type of material error or fraud and scope of analysis), cause, and effect. 3. Ppare an audiovisual (e.g., flowchart) that shows the flow of money from inception through final checks. The results of your assignment will be used as an addendum to the original report, schedule(s), and possibly a courtroom audiovisual. 5-2 HOW TO WRITE WORDING TO SUBPOENA DOCUMENTS, INFORMATION, AND/OR OBJECTS LEARNING OBJECTIVE After reading this section, you should be able to: 1. Ppare wording for a subpoena to obtain financial documents. 2. Be able to review the documents obtained by subpoena and determine whether you need additional documents. INTRODUCTION Financial and related information most often must be subpoenaed. Entities (corporations, limited liability companies, partnerships, etc.) that maintain financial and other information (e.g., audited and unaudited financial statements; tax returns; and bank, credit card, investment, and/or trust statements) have a fiduciary duty to protect that information, and most often will not provide requested information unless served with a valid subpoena ppared by a civil or criminal attorney associated with an open civil or criminal case (e.g., contract lawsuit, divorce proceedings, or criminal investigation). Individuals (and their unincorporated proprietorships) may invoke their right against self?incrimination and not provide anything in criminal (but not most civil) proceedings. This necessitates obtaining the information from other sources. There are two basic types of subpoenas. Subpoena duces tecum is a court order to a person or entity to attend court (or a grand jury) and bring relevant documents. Subpoena to testify is an order for a person to attend a hearing, grand jury, or deposition to testify. Each federal, state, and local court has its own civil and criminal variations. U.S. court samples are provided in the documents section. They illustrate civil and criminal subpoenas to provide documents, information, or objects and criminal subpoenas to testify in a deposition, grand jury, or hearing/trial. This study source was downloaded by 100000768677837 from CourseHero.com on 04-20-2023 09:53:54 GMT -05:00 https://www.coursehero.com/file/22900854/Fraud-Examination-CHAPTER-5/ The agents for and attorneys representing the entities receiving the subpoena will limit production to only what they determine has been requested. If the wording in a subpoena is poorly written, you may not get what you want. Even if well written, what is provided is limited to your request (e.g., canceled checks over $499.99), and when you review that information, you may have to ppare another subpoena (e.g., for selected checks, deposit tickets, and offsetting items deposited with the deposit ticket shown in the bank statement). NOTE: Subpoenas are often "fishing expeditions," and wording in the request may be challenged as overly broad. Compliance with a subpoena costs money (e.g., an hourly research fee, plus a set fee per item retrieved). Also, the wording can request ALL information (e.g., bank statements as well as all checks, deposit tickets, and offsetting items); however, subpoenas can be costly and response takes time. If you request too much information, the providing entity may charge an exorbitant amount for research and reproduction and/or take months to produce. What happens if you request all offsets to deposit tickets (checks, debit memorandums, etc.) from a wholesale or retail company? You might get hundreds of checks for customer payments. If you restrict the request to less information, you should get the response quicker and at a lower cost. However, it may necessitate more than one subpoena. Check with your attorney. It is his/her call on how broad or how limited to make the subpoena. Know your target! In this case, it is Greg Larsen DBA Larsen Convenience, who is a person and/or his alter ego (personally owned proprietorship). He most likely will not respond to a subpoena. If you subpoena Greg Larsen in a criminal case, he can invoke his right against self?incrimination. Records are often available elsewhere. You can, for instance, request Greg Larsen's information from a third party such as a financial institution. With taxing authorities, your attorney will have to request the information through an ex parte order before a judge, who decides whether to sign an order. This is needed particularly when obtaining tax returns from the Internal Revenue Service because of the secret nature of tax information. Following are samples of subpoena wording associated with requesting bank statements, checks, deposit tickets, and offsetting items. Note that "but not limited to" is added to cover that which you may not have requested:  Monthly bank statements and associated documents, including but not limited to, both the front and back of all checks, all deposit tickets, and offsetting items (checks, debit memorandums, etc.) for XYZ for the period ____________ to __________.  Monthly bank statements for XYZ for the period ____________ to __________.  The demand account documents, including but not limited to, the front and back of all checks, all deposit tickets, and offsetting items (checks, debit memorandums, etc.) for XYZ for the period ____________ to __________. This study source was downloaded by 100000768677837 from CourseHero.com on 04-20-2023 09:53:54 GMT -05:00 https://www.coursehero.com/file/22900854/Fraud-Examination-CHAPTER-5/  The savings account documents, including but not limited to, the front and back of all checks of $500.00 or more, all deposit tickets, and offsetting items (checks, debit memorandums, etc.) where each offset is $500.00 or more for XYZ for the period ____________ to __________.  For XYZ for the period ____________ to __________ provide the following to include but not limited to: (this prevents typing in the name of the subpoenaed person or entity and time period over and over). 5-3 EXERCISE?ANDERSON INTERNAL MEDICINE AND LARSEN CONVENIENCE STORE (CONSPIRACY AND LOAN FRAUD) EXERCISE 1: INDIVIDUAL ASSIGNMENT You find suspicious the $36,000.00 check deposited into the AIM checking account on December 30, 2015. It was made payable to "Cash" and drawn on Greg Larsen's account at Waleska Bank. Why was the $36,000.00 check deposited into AIM, and why were Larsen Convenience Store disbursements made using AIM checks? Accordingly, you want to review the financial information associated with that check: 1. Review the documents returned with the following: 1. The subpoena to the Bank of Lawrenceville to obtain Anderson Internal Medicine's demand account information for Account 7018188 for the period ending on or around December 31, 2015, including, but not limited to, the deposit ticket and front and back of the canceled check for $36,000.00, and the front and back of all canceled checks over $1,000.00 posted on or after December 30, 2015; 2. The subpoena to Waleska Bank to obtain the Greg Larsen's demand account information for Account 7011176 for the period ending on or after December 31, 2015, including, but not limited to, the monthly bank statement, all deposit tickets and off?setting items over $25,000.00, and the front and back of all canceled checks posted on or after the date of the aforementioned deposits over $25,000.00; and 3. The subpoena to Waleska Bank to get the credit application and the front and back of the canceled official checks associated with the $49,000.00 official check deposited into Greg Larsen's demand account on December 28, 2015. 2. Review the SIU interview of John Grayson. 3. Write up the fraud examination analysis for an addendum to the original fraud examination reports for both Larsen Convenience Store and Anderson Internal Medicine that discusses the results of your review. Be sure to briefly discuss what you did or did not d and the findings (condition, criteria, cause, and effect). 4. Ppare an audiovisual (e.g., flowchart) that shows the flow of money from inception through final checks.

Report of Interview Interviewee: John Grayson, Senior Vice President, Waleska Bank Interviewer: Raymond T. Boone, CFE Date: May 5, 2016 John Grayson is the Senior Vice President and Branch Manager for Waleska Bank (WB) branch located on Highway 5 in Ball Ground, Georgia. Mr. Grayson said that he personally knows Greg and Tonya Larsen, both of whom have banked with WB since 2003. He sees each several times a month in the bank and at the store. In addition to having a commercial checking account, Mr. Larsen has borrowed money on and off since 2006. Mr. Larsen has had a $50,000 line of credit since 2011 that he has used on occasion to pay his vendors until he built up his receipt balance. Based on his past history, Mr. Larsen pays off the line of credit within two to four weeks. Sometime after Christmas in late December 2015, Mr. Larsen approached him about a $50,000.00 loan to completely remodel his store. Mr. Larsen told John Grayson that he has new competition on Highway 5 from chain gas stations and needed additional funds to modernize his store and make it more appealing to customers. Mr. Larsen provided his 2013 and 2014 IRS Schedules C and monthly Georgia Sales and Use Tax forms for the last twelve months to verify the store's gross receipts and net income. Based on the long-term relationship with Greg Larsen, WB lent him $49,000.00 so Ramey Construction could start construction in January. When asked, John Grayson said that he was not aware when he approved the loan that Greg Larsen was having cash flow problems. Also, Mr. Grayson stated that he had not been in the store since Thanksgiving and was not aware of low inventory. John Grayson added that WB lost no money on the loan. It filed a Financing Statement with Cherokee County to protect its interest in the inventory and leasehold improvement. Although it was a second lien, WB received full repayment of principal and interest from the insurance company.