Good communication between a law firm and a forensic accountant is key to getting the best out of the work needed. Chris Paley-Menzies explains the questions lawyers should be thinking about


A forensic accountant's forte is taking a really thorny problem and pruning it away until an answer remains. This has traditionally been the province of paper, calculators and, more recently, spreadsheets. But today's cases almost always involve some sort of digital information-gathering exercise.



So, when a law firm needs to call on specialist forensic accounting advisers who have their own technology division, when is the best time to do that and what needs to happen on both sides to get the best out of the work?



The first question is: who do you choose to do the work? Selecting a big company will usually mean fees to match but you can be sure they will have the capacity to deal with your biggest cases.



But for the smaller jobs, a large company may not be able to scale their operation down enough to offer a properly-tailored service.



I have heard complaints of investigations being dealt with akin to a production line where the needs of the accountants were not being properly met.



Conversely, a smaller, niche practitioner may need to use partner firms, especially on the technology side, to meet your needs. There is nothing wrong with this approach, but make sure you are aware if this is happening and that you are entirely comfortable with their choice of sub-contractor.



In the example case I shall refer to, involving a claim relating to a warehouse in Russia that burned down, the case was run entirely by RGL involving two accountants (including a Russian) and me, the technology expert.



Look before you leap

The next question is: what are our requirements? Whatever they are, the mantra here is 'communicate, communicate, communicate'.



The accountants rely on the data collected by their technologist and, once that person is deep into the minutiae of a client's IT system and its data, it is easy to make assumptions on requirements.



I knew of a partner in a law firm who demanded 200 back-up tapes be restored whereas, after the back-up strategy had been discussed with the client's IT staff, it was determined that only a fraction of the tapes needed to be worked on to cover the period in question.



In our Russian case, the requirement was to take the stock records for the previous two years, which were all in disparate spreadsheets, clean them, join them together and then identify all relevant transactions. There were more than a million in all.



The analysis was done in tandem by an accountant and me. By applying complicated algorithms to the data, we were able to determine the potential age and thereby value of the destroyed stock.



Location can be important

Now where does the work need to be done? On the whole, it is not unusual for a forensic accountant to travel abroad to work on a case and it is not really more expensive to do it that way.



With the Russian case, we were lucky in that they were able to send the data to us for work in London but, in other cases and countries, it is not so clear-cut.



For example, there is a risk, when accessing the data on a personal computer, of being in breach of provisions such as the European Convention on Human Rights, as well as local laws.



A trip to Germany to do computer acquisitions was abandoned because the local and UK lawyers could not agree on whether or not we would be thrown into jail for doing the work.



Another consideration is the cost of having a computer forensics specialist on-site for multiple days weighed against the cost to the client's business of shipping their computer equipment to the forensics lab to get the data.



Acquiring the data in the forensics laboratory is cheaper but may not be the most effective way of working, especially if the computer of the client's managing director is included in the collection.



Keeping it in the family

Why not just use the client's own accountants? Why not use your own IT department to 'have a look'?



Forensic accountants work in a niche area and are very good at extracting information of and about companies and individuals. They provide independence, have the training and equipment, and, if you use a specialist firm which does not do audit or tax and so on, there are usually no conflict problems.



I think having computer and accountancy forensics under one roof means communication is smoothed and more effective, and, because of this, expectations are more easily met.



In our Russian case, the accountant worked on a small sample of the data to develop the formula needed for the analysis. This was then passed to me to convert into a script, which my powerful computer auditing tool could use and apply to the full data set.



Planning ahead

Ideally, the more notice given the better, as the more data there is to analyse, the longer it will take. But the process of gathering computer evidence should start as soon as possible, especially if there are a number of computers or systems involved.



A single PC can take a number of hours to examine, and restoring back-up tapes can take days. It is normally only after this process has started producing information that the accountants can get to work, and they are usually champing at the bit.



Chris Paley-Menzies is a forensic technology specialist at RGL, a forensic accountant and consultants firm



Next week: One of the Gazette's guinea pig IT testers reports on using the open source OpenOffice software on a 3G-equipped laptop.