Israel: Authentic Thinking In Tasks Requiring Investigative Auditing

Last Updated: 13 May 2013
Article by Doron Bergman

An investigative audit, as its name implies, combines two professional elements with essentially different attributes: accounting auditing and investigation. Auditing is a professional methodology founded on accounting principles, standards and theory. Investigation, on the other hand, is based on general principles that serve as guidelines and requires an investigator that is capable of "thinking outside the box", preferably in combination with the use of intuition. What is this "thinking outside the box" and "use of intuition" that are considered so important in investigative work, and especially in investigative auditing?

An investigator may be equated to a hunter who wishes to hunt the offender. The investigation, like a hunt, requires the development and application of several skills:

  • A critical approach, flexible thinking and the ability to doubt assumptions and suppositions (open mind)
  • Ability to develop and implement solutions for changing situations (practical dynamic)
  • Ability to understand and study the way of thinking and behavior of the person being investigated
  • High level of professional integrity
  • An approach based on appreciation of the person being investigated
  • Independent, low profile work

On the other hand, the auditor's work is based on professional methods and standards in which there is usually no room for personal development and they must be applied as-is, while cooperating with the person being audited. The need, therefore, to combine the skills is not self-evident, and therefore a professional specializing in investigative auditing must, first and foremost have the natural as well as acquired skills of an investigator who uses know-how in the field of auditing.

In quite a few cases, investigative auditing is conducted by accounting firms that provide external auditing services on an ongoing basis. In such cases, the professionals may use professional work methods and approaches that are accepted in auditing, but are not suitable for investigative auditing, and therefore may cause failure of the investigation.

In this article, I will present an example of this type of investigation, analysis of the causes of the failure, and offer an alternative way to conduct the investigation:

In a large manpower agency, large scale embezzlement by the company's HR manager was discovered. The manager served as the company's acting VP. The embezzlement and its perpetrator were discovered by chance, after one of the owners (the CEO) noticed in the bank account that a check was paid out to an employee that was fired six months before. When he checked the identity of the person cashing the check, he discovered that this was the HR manager. In addition, they found that the employee had been issued salary slips for the entire period during which he no longer worked for the company. The checks issued for these salary slips were also cashed or forwarded by the same HR manager. This senior employee, that had been working for the company for many years, and was actually its acting manager, was immediately summoned by the owners and shown the evidence – she admitted to the embezzlement of the specific checks, but refused to cooperate with information about additional checks. The employee was asked to leave work immediately, and other employees were informed.

The business owners contacted our accounting firm and requested an investigation (external audit) to determine the scope of the embezzlement, how it was performed and to collect evidence against the employee for the purpose of a possible lawsuit. It should be noted that over the years the auditing accountants had noted an improper accounting level and breaches in the internal control, especially relating to this specific employee, but had not managed to affect a change in the situation.

The investigation by an accounting firm was performed by two accountants that were assigned to this task exclusively in order to accelerate the investigation, because the owners viewed this as urgent and wished to receive an estimate of the scale of the embezzlement as quickly as possible. During two weeks the accountants tried to find a "clue" or lead as to the manner of execution of the embezzlement by tracking the transactions performed in the financial reporting system, especially at the end of the year and beginning of a new year, before the annual audit, yet they did not focus on the logistic computer system that was actually at the center of the company's operations. The accountants' assumption was that examining bank reconciliations would provide the lead based on which it would be possible to track the employee's method and formulate an estimate of the scope of the embezzlement. After two weeks that the accountant tried to find the source of the embezzlement in the accounting ledgers of the previous years – they realized that due to inadequate accounting reflected in forced bank reconciliations that were usually made without any valid references, and with essential deficiencies in the recording of accounting transactions, it was absolutely impossible to identify the sources and the scope of the embezzlement this way. When they realized that the financial system would not produce the solution – emphasis shifted to the logistics system that the accountants hoped to use to identify embezzlement using additional fictitious employees or fictitious work hours. This method did indeed reveal several checks that were cashed that belonged to the same embezzlement, yet it also indicated breaches that existed in both the logistics system and its interface with the financial system. These breaches made it significantly harder to identify, in a reasonable period of time, the scope of the embezzlement and estimate of the number of years that it has been going on. At this stage, the owners lost faith in the accountants' ability to give them what they asked for, and therefore approved only a few more days for the investigation.

It should be noted that the accountants began their investigation based on an assumption that the embezzling employee had no accounting knowledge, and therefore inferred that she was not sophisticated – and assumed that this would facilitate the investigation and attainment of the goals.

At this stage, an old checkbook was found that did not contain any more checks. Examination of the check stubs found 5 additional checks, that were allegedly given to the employee who was fired 6 months earlier, and were cashed, as well as other checks that further investigation found were either assigned or cashed by the senior employee. Examination of the accounting system found that details about the cashing of these checks were missing.

The accountants did not place great importance on this, and continued to conduct their investigation in the company's office with the goal of uncovering additional cases related to this embezzlement. A few days later, the owners notified the accountants that they no longer wished them to continue the investigation, since they do not believe that the accountants have an affective investigation direction that will lead to the goals they set.

What exactly happened, and how could this outcome have been avoided?

  • Embezzlements are usually classified as white collar crimes that have different characteristics than ordinary crimes. In the case of ordinary crimes, the nature of the offense is usually known, and it is necessary to find the criminal. In white collar crime, the criminal is known, but it is necessary to find and consolidate evidence related to the scope and implications of the crime. In both cases evidence serves as the basis for convicting the criminal.

    As important as evidence is in the conviction of an ordinary criminal, its importance is even greater in the conviction of white collar criminals, with the investigation usually starting with meager evidence about the nature and scope of the crime. In addition, the standing in the organization of white collar crime defendants enables concealment of the crime for long periods of time. In such cases, conducting a low profile investigation is an essential condition for the investigation's success. This did not occur in this case, as reflected in:
  1. The investigation was conducted, from the very beginning, in the company' offices.
  2. The employees were notified that the senior employee has been dismissed and the reason for her dismissal.
  3. The employee was dismissed hastily before consolidating additional evidence that was required, especially in light of the company's accounting system.

Choosing an alternative approach, that includes:

  • Using much more discrete investigation methods
  • Postponing the confrontation with the senior employee, that was held in the manager's office, to a later stage (preferably not in the company's offices)
  • Considering leaving the senior employee in her position and tracking her actions (low profile) – this could have enabled the accountants to uncover the embezzlement method and even expose additional evidence that may perhaps have cut the investigation short and improved its chances of success.
  • Lack of a guiding principle for conducting the investigation - in light of examination of the existing data, the logistic system and the company's actions.

The accountants remained fixed on the accounting tools at their disposal, and did not examine the existing data and other findings that could hint at more focused investigation directions that are based on a proper assessment of the employee's skills. The investigators evaluated the defendant's skills based on the professional tools they are familiar with, and did not try to understand her way of thinking. This fixed, rigid approach that was also apparent in how they evaluated her – was one of the elements that contributed to the investigation's lack of success. Looking at the situation from an objective point of view, it seems reasonable to assume that an embezzlement that was conducted over a long period of time, at the scope that was revealed, and one that was not discovered by the owners and not by accountants during two annual audits – means that we are dealing with a sophisticated suspect requiring suitable preparation. The waste of time due to the rigid approach of the accountants caused the investigation to lag and be one step behind , and finally to fail.

  • Additional findings: the accountants obtained significant information during the investigation from the checkbook that contained the checks that were issued to fictitious parties and then assigned or cashed by the employee – but unfortunately they did not make proper use of this valuable information. It is reasonable to assume that had they made astute use of the information, they would have discovered a clue or lead that may have enabled them to quickly determine the scope of the embezzlement and the method that was used.


On the one hand, the case involves an accounting system characterized by irregularities that allowed extensive breaches and precluded effective control and monitoring. On the other hand, the checkbook that was found could explain how the HR manager carried out the embezzlement. Firstly, in order not to leave tracks, she apparently wrote all the checks that she cashed or assigned in separate checkbooks, whose stubs were not forwarded to accounting, and therefore their identifying details were not recorded. This faithfully reflects the actual findings on the ground.

The HR manager ensured that she would have full control, as long as no orderly bank reconciliation were conducted, and she was well aware that she was capable of creating conditions in which it would not be possible to conduct updated bank reconciliation for the audit date by debiting salaries on several dates every month, with her excuse being logistic constraints. Her exclusive control of HR and the trust placed in her allowed the HR manager to do as she liked. This trust was reflected in the fact that she was given signed, non-computerized checkbooks by the owners. In fact, she was given free access to the business' bank account, and her situation was superior to that of each of the owners, since each owner needed to obtain his partner's signature to withdraw money from their joint account.

A proposed alternative line of investigation in light of the findings uncovered

In light of the finding, there is a real chance (that must be examined) that had a mapping of the checkbooks been undertaken, with their copies being sent to accounting (external) for the purpose of recording and then returning them to the company, it would have been possible to identify the missing checkbooks and their numbers. Sending the numbers of the checks to the bank may have taught us that the checks were assigned or cashed by the HR manager, and it would have been possible to quickly estimate the scope of the embezzlement, to obtain references that would serve as evidence for the lawsuit, and even to learn the method the HR manager used based on the evidence gathered. This would have prevented the barren attempt to find a needle in a haystack, and could possibly have minimized damages, including the damage that the investigation caused to the other employees.

Some people would claim that such a strategy does not require in-depth accounting know-how – and this is true, but also irrelevant! An investigator is supposed to complete his assignment, which in this case included estimating the scope of the embezzlement, collecting quality findings and exposing the manner of operation, as far as possible. In order to do this, he must use the most suitable legal tools to attain the objective – and this is the only consideration that should guide him!

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.

To print this article, all you need is to be registered on

Click to Login as an existing user or Register so you can print this article.

Some comments from our readers…
“The articles are extremely timely and highly applicable”
“I often find critical information not available elsewhere”
“As in-house counsel, Mondaq’s service is of great value”

Related Topics
Related Articles
Up-coming Events Search
Font Size:
Mondaq on Twitter
Mondaq Free Registration
Gain access to Mondaq global archive of over 375,000 articles covering 200 countries with a personalised News Alert and automatic login on this device.
Mondaq News Alert (some suggested topics and region)
Select Topics
Registration (please scroll down to set your data preferences)

Mondaq Ltd requires you to register and provide information that personally identifies you, including your content preferences, for three primary purposes (full details of Mondaq’s use of your personal data can be found in our Privacy and Cookies Notice):

  • To allow you to personalize the Mondaq websites you are visiting to show content ("Content") relevant to your interests.
  • To enable features such as password reminder, news alerts, email a colleague, and linking from Mondaq (and its affiliate sites) to your website.
  • To produce demographic feedback for our content providers ("Contributors") who contribute Content for free for your use.

Mondaq hopes that our registered users will support us in maintaining our free to view business model by consenting to our use of your personal data as described below.

Mondaq has a "free to view" business model. Our services are paid for by Contributors in exchange for Mondaq providing them with access to information about who accesses their content. Once personal data is transferred to our Contributors they become a data controller of this personal data. They use it to measure the response that their articles are receiving, as a form of market research. They may also use it to provide Mondaq users with information about their products and services.

Details of each Contributor to which your personal data will be transferred is clearly stated within the Content that you access. For full details of how this Contributor will use your personal data, you should review the Contributor’s own Privacy Notice.

Please indicate your preference below:

Yes, I am happy to support Mondaq in maintaining its free to view business model by agreeing to allow Mondaq to share my personal data with Contributors whose Content I access
No, I do not want Mondaq to share my personal data with Contributors

Also please let us know whether you are happy to receive communications promoting products and services offered by Mondaq:

Yes, I am happy to received promotional communications from Mondaq
No, please do not send me promotional communications from Mondaq
Terms & Conditions (the Website) is owned and managed by Mondaq Ltd (Mondaq). Mondaq grants you a non-exclusive, revocable licence to access the Website and associated services, such as the Mondaq News Alerts (Services), subject to and in consideration of your compliance with the following terms and conditions of use (Terms). Your use of the Website and/or Services constitutes your agreement to the Terms. Mondaq may terminate your use of the Website and Services if you are in breach of these Terms or if Mondaq decides to terminate the licence granted hereunder for any reason whatsoever.

Use of

To Use you must be: eighteen (18) years old or over; legally capable of entering into binding contracts; and not in any way prohibited by the applicable law to enter into these Terms in the jurisdiction which you are currently located.

You may use the Website as an unregistered user, however, you are required to register as a user if you wish to read the full text of the Content or to receive the Services.

You may not modify, publish, transmit, transfer or sell, reproduce, create derivative works from, distribute, perform, link, display, or in any way exploit any of the Content, in whole or in part, except as expressly permitted in these Terms or with the prior written consent of Mondaq. You may not use electronic or other means to extract details or information from the Content. Nor shall you extract information about users or Contributors in order to offer them any services or products.

In your use of the Website and/or Services you shall: comply with all applicable laws, regulations, directives and legislations which apply to your Use of the Website and/or Services in whatever country you are physically located including without limitation any and all consumer law, export control laws and regulations; provide to us true, correct and accurate information and promptly inform us in the event that any information that you have provided to us changes or becomes inaccurate; notify Mondaq immediately of any circumstances where you have reason to believe that any Intellectual Property Rights or any other rights of any third party may have been infringed; co-operate with reasonable security or other checks or requests for information made by Mondaq from time to time; and at all times be fully liable for the breach of any of these Terms by a third party using your login details to access the Website and/or Services

however, you shall not: do anything likely to impair, interfere with or damage or cause harm or distress to any persons, or the network; do anything that will infringe any Intellectual Property Rights or other rights of Mondaq or any third party; or use the Website, Services and/or Content otherwise than in accordance with these Terms; use any trade marks or service marks of Mondaq or the Contributors, or do anything which may be seen to take unfair advantage of the reputation and goodwill of Mondaq or the Contributors, or the Website, Services and/or Content.

Mondaq reserves the right, in its sole discretion, to take any action that it deems necessary and appropriate in the event it considers that there is a breach or threatened breach of the Terms.

Mondaq’s Rights and Obligations

Unless otherwise expressly set out to the contrary, nothing in these Terms shall serve to transfer from Mondaq to you, any Intellectual Property Rights owned by and/or licensed to Mondaq and all rights, title and interest in and to such Intellectual Property Rights will remain exclusively with Mondaq and/or its licensors.

Mondaq shall use its reasonable endeavours to make the Website and Services available to you at all times, but we cannot guarantee an uninterrupted and fault free service.

Mondaq reserves the right to make changes to the services and/or the Website or part thereof, from time to time, and we may add, remove, modify and/or vary any elements of features and functionalities of the Website or the services.

Mondaq also reserves the right from time to time to monitor your Use of the Website and/or services.


The Content is general information only. It is not intended to constitute legal advice or seek to be the complete and comprehensive statement of the law, nor is it intended to address your specific requirements or provide advice on which reliance should be placed. Mondaq and/or its Contributors and other suppliers make no representations about the suitability of the information contained in the Content for any purpose. All Content provided "as is" without warranty of any kind. Mondaq and/or its Contributors and other suppliers hereby exclude and disclaim all representations, warranties or guarantees with regard to the Content, including all implied warranties and conditions of merchantability, fitness for a particular purpose, title and non-infringement. To the maximum extent permitted by law, Mondaq expressly excludes all representations, warranties, obligations, and liabilities arising out of or in connection with all Content. In no event shall Mondaq and/or its respective suppliers be liable for any special, indirect or consequential damages or any damages whatsoever resulting from loss of use, data or profits, whether in an action of contract, negligence or other tortious action, arising out of or in connection with the use of the Content or performance of Mondaq’s Services.


Mondaq may alter or amend these Terms by amending them on the Website. By continuing to Use the Services and/or the Website after such amendment, you will be deemed to have accepted any amendment to these Terms.

These Terms shall be governed by and construed in accordance with the laws of England and Wales and you irrevocably submit to the exclusive jurisdiction of the courts of England and Wales to settle any dispute which may arise out of or in connection with these Terms. If you live outside the United Kingdom, English law shall apply only to the extent that English law shall not deprive you of any legal protection accorded in accordance with the law of the place where you are habitually resident ("Local Law"). In the event English law deprives you of any legal protection which is accorded to you under Local Law, then these terms shall be governed by Local Law and any dispute or claim arising out of or in connection with these Terms shall be subject to the non-exclusive jurisdiction of the courts where you are habitually resident.

You may print and keep a copy of these Terms, which form the entire agreement between you and Mondaq and supersede any other communications or advertising in respect of the Service and/or the Website.

No delay in exercising or non-exercise by you and/or Mondaq of any of its rights under or in connection with these Terms shall operate as a waiver or release of each of your or Mondaq’s right. Rather, any such waiver or release must be specifically granted in writing signed by the party granting it.

If any part of these Terms is held unenforceable, that part shall be enforced to the maximum extent permissible so as to give effect to the intent of the parties, and the Terms shall continue in full force and effect.

Mondaq shall not incur any liability to you on account of any loss or damage resulting from any delay or failure to perform all or any part of these Terms if such delay or failure is caused, in whole or in part, by events, occurrences, or causes beyond the control of Mondaq. Such events, occurrences or causes will include, without limitation, acts of God, strikes, lockouts, server and network failure, riots, acts of war, earthquakes, fire and explosions.

By clicking Register you state you have read and agree to our Terms and Conditions