Private policing of white-collar crime: case studies of internal investigations by fraud examiners

ABSTRACT

Private policing of white-collar crime has been a controversial issue for quite some time. Fraud examiners from global auditing firms and local law firms conduct internal investigations, resulting in reports of investigations that are the clients’ confidential property. This article presents four disclosed reports of investigations to illustrate the theory of convenience for white-collar crime and to determine the examination maturity in private policing. The suggested maturity model with five levels determines whether the investigation as chaotic or messy, or whether the investigation contributed to disclosure or clarification. The most mature level is investment, where the benefits of the examination exceed the costs of the examination. Many fraud examiners have a long way to go before them deserve the label of professional investigators or examiners. Future research may help professionalize the business of private policing of economic crime. The four reports of investigations are from Moldova, the Netherlands, Sweden, and Switzerland.

KEYWORDS:

• Private policing
• white-collar crime
• fraud examination
• internal investigation
• case study

Introduction

Two decades have soon passed since Schneider (2006) and Williams (2005) emphasized the problematic role of fraud examiners in internal investigations, as examiners conduct private policing of economic crime. In the meantime, the business of fraud examinations has grown substantially in forensic departments in auditing firms and in consulting departments in law firms. Examples include Clifford Chance (2020), Garcia (2019), Kroll (2016, 2017), and Sands (2019a, 2019b). This article develops these four examples into case studies of private policing of economic crime in terms of internal investigations by fraud examiners. The purpose is to illustrate various levels of maturity in the private policing business.

Literature review

Private policing is provision of policing services such as investigations and detective work other than by public servants in the normal course of their public duties. The public policing function is typically located in a government body, while private policing in the area of fraud examinations is typically located in auditing firms and law firms. The authority and tools of a policing entity range from full legal authority granted to the office of the public police, to no special authority at all beyond that provided by the clients of fraud examinations. Beneficiaries can range from everyone as in the case of public policing, to only those entities that fund policing. Furthermore, ‘the public police, as an institution of the criminal justice system, inherently possess a punishment or coercion-based mentality propelled by their authority as agents of the criminal law and their capacity to apply state-sanctioned force’ (Wood, 2020, p. 25). In contrast, private policing of economic crime is consulting work where fraud examiners conduct internal investigations to establish facts and advise clients what to do next.

The business of private policing by fraud examiners seems to be growing more rapidly than national and international public police organizations to combat fraud (Wood, 2020, p. 26):

Determining the ratios of private agents to public agents is invariability hard to do with much accuracy, but it is clear that private policing entities surpass the latter in sheer numbers and to varying degrees across established democracies and countries in transition.

The purpose of this article is to study cases of internal investigations by fraud examiners. The article presents a stage model for maturity in private policing and applies the maturity model to each case study. The four cases resulted from a search for investigation reports. Client firms who hire investigators tend to keep internal reports by fraud examiners secret. They do not want to disclose the contents to the media or the public in general. Even when there is suspicion of serious economic crime, many clients prefer not to disclose reports to the police (P. Gottschalk & Tcherni-Buzzeo, 2017). ‘Typically, corporations tend to take their own measures to resolve instances of fraud without resorting to the police’ (King, 2020). Therefore, we cannot generalize the extent of fraud examination maturity based on our sample of only four reports. King (2020) argues that nine attributes are critical for the corporate investigator’s inquiry success: communication, motivation, industry experience, qualifications, police or regulatory experience, business acumen, conceptual thinking, resilience, and rapport building.

Figure 1 illustrates the maturity model that we apply in this research. Stages of growth models for maturity levels help to assess and evaluate a variety of phenomena (e.g. Röglinger et al., 2012; Solli-Sæther & Gottschalk, 2015). Here we apply the concept of maturity levels to evaluate private internal investigations (Brooks & Button, 2011; Button et al., 2007a; Button & Gee, 2013; Button et al., 2007b; Schneider, 2006; Williams, 2005). The purpose is to develop characteristics of investigations at different maturity levels. Based on previous studies of investigation reports (P. Gottschalk, 2020), we present a five-stage model as illustrated in the figure.

Figure 1. Maturity model for internal private investigations with five stages

The five maturity levels in the stage model for private policing have the following descriptions:

1. The investigation was a chaos. The investigation caused more confusion than before the examination was initiated. The investigation was insufficient, inadequate, surface-oriented, a waste of time, useless, passive, unprofessional, worthless, immature, unacceptable, bad, meaningless, fruitless, awful, and chaotic. The investigation was a failure and a disaster.

2. The investigation was a mess. Nothing came out of the investigation. The investigation was random, amateur, formalities focused, somewhat good, sufficient, descriptive, problem-oriented, neutral, unsystematic, inadequate, activity-oriented, shortsighted, fruitless, deviations-oriented, reactive, questions-oriented, and messy. The investigation lacked scrutiny, was a collection of information without analysis, and had too many assumptions that made conclusions invalid.

3. The investigation was a disclosure. Examiners were successful in identifying and documenting some new facts. The investigation had a clear perspective; it was competence-oriented, average, biased, targeted, systematized, integrated, moderate, indifferent, standard, competent, cause-based, revealing, and disclosure-oriented. The investigation was problem-oriented and limited by the mandate.

4. The investigation was a clarification. The investigation was able to reconstruct past events and sequences of events. The investigation was responsible, detailed, conscientious, sufficient, professional, neutral, unprejudiced, integrated, proactive, preventive, mature, competent, systematic, professional, explorative, immaculate, expedient, truth-seeking, facts-based, complete, independent, and clarifying. The investigation added value.

5. The investigation was an investment. The investigation made a valuable contribution to the organization, where investigation benefits exceed investigation costs. The investigation was optimal, innovative, profitable, strategic, extraordinary, outstanding, provident, value-oriented, advanced, learning-focused, valuable, irreversible, truth-based, socially responsible, exceptional, excellent, perfect, exemplary, and a profitable investment. The investigation was a masterpiece and enrichment for the client and society.

Each case study in this article applies the described model of maturity in private policing. Each case study also applies the structural model of convenience theory as illustrated in Figure 2. The emerging theory of convenience for white-collar crime is concerned with financial possibilities and threats, organizational opportunity to commit and conceal financial crime, as well as personal willingness for deviant behavior. The research literature on convenience theory is growing (e.g. Braaten & Vaughn, 2019; Chan & Gibbs, 2020; P. Gottschalk, 2019; Hansen, 2020; Kireenko et al., 2019; Leasure & Zhang, 2018; Otu & Okon, 2019; Reese & McDougal, 2018; Vasiu & Podgor, 2019).

Figure 2. Structural model of convenience theory for white-collar crime

White-collar offenders commit financial crime in the course of their occupations (Craig, 2019; Craig and Piquero, 2016; Dearden, 2017; Jordanoska, 2018; Onna and Denkers, 2019). Convenience theory suggests that the financial motive in white-collar crime is to explore possibilities and avoid threats; the organizational opportunity is to commit as well as conceal crime, while the willingness is deviant behavior by justification and neutralization (Vasiu & Podgor, 2019). The theory of convenience is an integrated and deductive perspective based on the synthesis of individual-level, group-level, and nation-level themes (Chan & Gibbs, 2020; P. Gottschalk, 2019). Convenience theory builds on previous theoretical perspectives on fraud, such as the fraud triangle, the fraud scale, the fraud diamond, the MICE model, and the ABC model (Desai, 2020), as well as general theoretical perspectives on economic crime (P. Gottschalk, 2019).

Convenience is the state of being able to proceed with something with little effort or difficulty, avoiding pain and strain (Mai & Olsen, 2016). Convenience is savings in time and effort (Farquhar & Rowley, 2009), as well as avoidance of pain and obstacles (Higgins, 1997). Convenience is a relative concept concerned with the efficiency in time and effort as well as reduction in pain and solution to problems (Engdahl, 2015). Convenience is an advantage in favor of a specific action to the detriment of alternative actions. White-collar offenders choose the most convenient path to reach their goals (Wikstrom et al., 2018).

White-collar crime results from delinquent behavior by individuals in competent positions (Piquero, 2018). White-collar offenders commit and conceal their crime in a professional setting (Yeok et al., 2020) where they have legitimate access to premises, resources, and systems (Logan et al., 2019). The benefit from white-collar crime might be financial gain, personal adventure, or some other desired outcome (Craig & Piquero, 2017; Jordanoska, 2018; Sutherland, 1939; Sutherland, 1983; Williams et al., 2019).

Figure 2 illustrates the structure of white-collar convenience as derived from the research literature within criminology, sociology, psychology, and management (P. Gottschalk, 2019). The extent of white-collar crime convenience manifests itself by motive, opportunity, and willingness. The motive is either occupational crime to benefit the individual or corporate crime to benefit the organization because of possibilities or threats. The ability of white-collar offenders to commit and conceal crime links to their privileged position, the social structure, and their orientation to legitimate and respectable careers (Friedrichs et al., 2018). The personal willingness for deviant behavior manifests itself by offender choice and perceived innocence. The choice of crime can be caused by deviant identity, rational consideration, or learning from others. The perceived innocence at crime manifests itself by justification and neutralization (Schoultz & Flyghed, 2020). Identity, rationality, learning, justification, neutralization, and lack of self-control all contribute to making white-collar crime action a convenient behavior for offenders (Craig & Piquero, 2017; Engdahl, 2015; Holtfreter et al., 2010; Sutherland, 1983; Sykes & Matza, 1957).

In criminology, the conceptualization of deviant behavior is implicitly negative actions that lack conformity to norms (Sykes & Matza, 1957). Deviant behavior typically causes harm to victims. Offenders depart from norms in destructive ways. In our context, deviance is negative departure from norms by white-collar offenders (P. Gottschalk, 2019, 2020).

White-collar offenders commit economic crime where a great variety of options of financial misconduct are available to them, as illustrated in Figure 3. Fraud, theft, manipulation, and corruption are four main categories of financial crime with a number of sub-categories. Fraud is intentional perversion of the truth for inducing another in reliance upon it to part with some valuable thing belonging to him or to surrender a legal right. Fraud is unlawful and intentional making of a misrepresentation, which causes actual prejudice or which is potentially prejudicial to another. Bank fraud is a typical example. Bank fraud is a criminal offence of knowingly executing a scheme to defraud a financial institution.

Figure 3. Main categories and sub categories of e-crime

Theft is the illegal taking of property from another person, group, or organization without the victim’s consent. For example, identity theft combined with identity fraud is the unlawful use of another’s personal identifying information. It involves financial or other personal information stolen with the intent of establishing another person’s identity as the thief’s own. It occurs when someone uses personally identifying information, like name, social security number and date of birth, government passport number, or credit card number without the owners’ permission, to commit economic crime.

Manipulation is a form of cheating where the offender breaks the rules while deliberately leading or allowing others to think the offender respects the rules (Eabrasu, 2020). Manipulation is a means of gaining illegal control or influence over others’ activities, tools, and results. For example, bankruptcy crime is criminal act committed in connection with bankruptcy or liquidation proceedings. A person filing for bankruptcy or a business that has gone into liquidation can hide assets after proceedings start. Thereby fraudsters can prevent creditors from collecting their valuable belongings. However, most of the criminal acts are typically committed before bankruptcy/liquidation proceedings start, e.g. the debtor has failed to keep accounts or has unlawfully withdrawn money from the business.

Corruption is the giving, requesting, receiving, or accepting of an improper advantage related to a position, office, or assignment. The improper advantage does not have to relate to a specific action or to not doing this action. It will be sufficient if the advantage connects to a person’s position, office, or assignment. An individual or group is guilty of corruption if they accept money or money’s worth for doing something that he is under a duty to do anyway, that he is under a duty not to do, or to exercise a legitimate discretion for improper reason. Corruption is to destroy or pervert the integrity or fidelity of a person in his discharge of duty, it is to induce to act dishonestly or unfaithfully, it is to make venal, and it is to bribe. Corruption involves behavior on the part of officials in the public or private sectors, in which they improperly and unlawfully enrich themselves and/or those close to them, or induce others to do so, by misusing the position in which they find themselves. Corruption covers a wide range of illegal activities such as kickbacks, embezzlement, and extortion.

The methodology applied to investigation reports in this research is content analysis (Bell et al., 2018; Braaten & Vaughn, 2019; Saunders et al., 2007). Content analysis is any methodology or procedure that works to identify characteristics within texts attempting to make valid inferences (Krippendorff, 1980; Patrucco et al., 2017). Content analysis assumes that language reflects both how people understand their surroundings and their cognitive processes. Therefore, content analysis makes it possible to identify and determine relevant text in a context (McClelland et al., 2010).

Case 1: Swedbank by Clifford Chance

Swedbank carried out bank transactions of more than 37 billion Euros (about US$40 billion) with a high risk for money laundering over a five-year period according to private policing in terms of an internal investigation by fraud examiners from law firm Clifford Chance (2020). The investigation report suggests that the Swedish bank actively targeted high-risk individuals in the Baltic region and points to failings from both top management and the board (Milne, 2020).

Birgitte Bonnessen was the chief executive officer (CEO) at Swedbank. She had to leave the position in 2019 (Makortoff, 2019). When Clifford Chance (2020) presented their report of investigation, the new Swedbank board decided to withdraw her final compensation of 26 million Swedish kroner (US$2.7 million). At the same time, Swedbank accepted a fine of 4 billion Swedish kroner (US$408 million) from the Swedish finance inspection (Johannessen and Christensen, 2020).

White-collar convenience

The bank benefitted from having oligarchs and other Russians as customers without implementing anti-laundering procedures. The motive for violating anti-money laundering laws was for Swedbank to make extraordinary profits by corporate crime (Naylor, 2003), as illustrated by the convenience theme motive-possibilities-corporate in Figure 4. Swedbank executives had a high status (Agnew, 2014), that allowed them to implement special arrangements for non-resident clients. They could claim that the act of wrongdoing is morally justifiable (Schnatterly et al., 2018), probably based on upper echelon information selection (Gamache & McNamara, 2019). A CEO such as Birgitte Bonnessen might suffer from narcissistic traits (Zhu & Chen, 2015), where she constructed her own professional world (Chatterjee & Pollock, 2017). Many CEOs tend to have a temporal focus (Gamache & McNamara, 2019). Schnatterly et al. (2018) found that pressure, opportunity, and rationalization cause CEO wrongdoing.

Figure 4. Convenience themes in the case of Swedbank

Fraud examination outcome

Fraud examiners from law firm Clifford Chance failed in determining whether money laundering had actually occurred in Swedbank’s subsidiaries in Estonia, Latvia, or Lithuania. In fact, they did not even try to collect evidence of money laundering activities (Clifford Chance, 2020, p. 8):

Inclusion in the group of AML risk identified customers is not necessarily indicative of suspicious behavior or improper conduct. Rather, these parameters were designed to capture the portion of the Baltic subsidiaries’ customer population that warranted further review. In addition, the fact that an external payment to or from one of these customers hit against one or more of the detection algorithms does not mean that the payment should have been considered suspicious at the time, let alone is it evidence that a customer engaged in money laundering or other financial crime. Rather the detection algorithms are designed to identify transactions with risk indicators similar to those that a transaction monitoring system would flag for further review.

Rather than collecting evidence on money laundering activities, such as circular transfers by suspected non-resident companies, fraud examiners collected only evidence on misconduct in terms of failing anti-money laundering work in the Baltic subsidiaries. The word ‘evidence’ is subject to repetition several times in the investigation report, however mainly in terms of not identifying evidence rather than identifying evidence. For example, ‘the investigation did not identify evidence that these issues were presented to the Board’ (Chance, 2020, p. 83), which simply means that to the extent board members learned about misconduct, this was of course not documented in formal ways. Chance (2020, p. 84) continues to emphasize that reports were not ‘provided to the Board or its committees’.

Investigators found evidence of two Russian oligarchs who moved ‘funds among related accounts in Swedbank Estonia’ (Clifford Chance, 2020, p. 87). Again, investigators failed in identifying potential evidence of money laundering activities among Russian oligarchs and other non-resident bank clients in Estonia, Latvia, or Lithuania.

FTI Consulting provided forensic support to Clifford Chance. They collected and analyzed transactions processed by Swedbank Estonia, Latvia, and Lithuania. In Estonia, FTI identified 338,000 messages that reflected search terms. FTI then determined that 7,100 of these messages contained true hits against search terms defined by the United States Treasury Department’s Office of Foreign Assets Control. From further study of those messages, FTI assembled 3,037 transactions for legal review, supplemented by customers from Internet addresses in embargoed countries. The fraud examiners ended up identifying 19 sanctioned corporate customers. The fraud examiners obtained similar results for Latvia and Lithuania.

Private policing evaluation

Chapter VII in the report is presenting the investigation’s findings and conclusions. The chapter is 125 pages out of the 216-pages report. The chapter tells a story of developments, but it does not reconstruct past events or sequences of events as required from a fraud examination. Even worse, there are no real conclusions, although the title of Chapter VII claims there will be a conclusion. As a result, and because of the lack of evidence of money laundering, Figure 5 illustrates that the Clifford Chance (2020) investigation report only reaches level two in terms of fraud examination maturity.

Figure 5. Maturity model for internal private investigations applied to Clifford Chance

Rather than trying to find the underlying cause of rumors and accusations concerning misconduct and crime in the form of money laundering, examiners spend time telling how Swedbank’s current board and management intend to implement new approaches to compliance and anti-money laundering (Clifford Chance, 2020, p. 178):

Swedbank has focused over the past year on transforming its approach to AML/CTF and sanctions compliance, creating new roles, appointing new personnel, increasing resources, revising and strengthening policies and procedures, and taking steps to de-risk tis customer portfolio including in the Baltic subsidiaries.

It is naïve to believe that things will change simply because there are changes in top management and because those new executives in charge express ethical intentions. Fraud examiner David di Bari chose to include a whole chapter on remediation and nice words about the current bank management. Maybe he did so to please the new top executives, who are to pay for the investigation by Clifford Chance (2020).

Case 2: Fifa world cup by Garcia

Media reports have suggested that the reason why Fifa world cups ended up in Russia in 2018 and in Qatar in 2022 was corruption. Members of the executive committee at Fifa did not only receive bribes from the winning nations Russia and Qatar but also from losing competitors such as Australia. On 2 December 2010, the executive committee of the international football association Fifa, using an anonymous voting procedure, determined the hosts for the 2018 and 2022 Fifa world cup tournaments. Allegations of corruption related to the voting process had surfaced even before the final vote that December day in Zürich in Switzerland. Ever since, there have been persistent allegations of misconduct with respect to the selection process. In 2017, British newspaper The Guardian reported that a Fifa official allegedly took bribes to back Qatar’s 2022 world cup bid (Laughland, 2017):

Julio Grondona, a senior vice-president at Fifa and head of the Argentinian football association until his death in 2014, allegedly told the witness, Alejandro Burzaco, an Argentinian sports marketing executive, that he was owed the money in exchange for his vote, which helped Qatar secure the lucrative tournament.

Three years earlier, in 2014, the Garcia report was completed. The Garcia (2014) report was an investigation produced by Michael Garcia and Cornel Borbély into allegations of corruption in world association football. Fifa appointed Garcia and Borbély in 2012 to investigate ethical breaches at Fifa, which is world football’s governing body. The two examiners quickly focused on persistent public accusations of bribery in the 2018 and 2022 world cup bids, which Russia and Qatar respectively won in 2010. Fifa kept the Garcia report secret for several years before it leaked to a German newspaper, which caused Fifa subsequently to release the report to the public by Fifa in 2017.

White-collar convenience

Both briber and bribed in a corruption relationship have their financial motives, organizational opportunities, and willingness for deviant behaviors. In Figure 6, illustrations for the briber are with texture, while illustrations for the bribed are with dark grey. The briber has a motive of winning the bid for the world cup, which leads to prestige for the country. It is a situation where business objectives justify means (Jonnergård et al., 2010).

Figure 6. Convenience themes in the case of Fifa

The bribed committee member can make an extraordinary profit, which is possible because of the position at Fifa (Pontell et al., 2014). The briber has access to resources to bribe members (Benson & Simpson, 2018). It is a rational choice for the briber to get involved in corruption to improve the nation’s chance of winning the bid (Pratt & Cullen, 2005). The bribed can neutralize the potential feeling of guilt by arguing that his or her vote did not change (Sykes & Matza, 1957).

Fraud examination outcome

From the perspective of evolving accounts, as scandals arrive at the attention of stakeholders and the public (P. Gottschalk & Benson, 2020), the Fifa scandal is a typical example (Hundt & Horsch, 2019; Naheem, 2018). Persistent public accusations of bribery and corruption forced top officials at Fifa to initiate an investigation. Initially, the Swiss Joseph Blatter, president of Fifa since 1998, denied any wrongdoing. However, Blatter had to resign in 2015 when the Swiss attorney general announced criminal proceedings against him regarding criminal mismanagement and misappropriation. Swiss police arrested seven Fifa officials at hotel Baur au Lac in Zürich. FBI in the United States arrested other Fifa officials and charged them with corruption (Viswanatha et al., 2015).

The 350-page report of investigation mentions Fifa president Joseph ‘Sepp’ Blatter 81 times. The corporate investigators conclude that Blatter was responsible for mismanagement, but not fraud (Garcia, 2014, p. 336):

President Blatter’s responsibility for the myriad issues that developed over the course of the bidding process or were uncovered by this inquiry merits consideration. As a preliminary matter, it must be made clear that evidence in the record does not establish a prima facie case that President Blatter violated the FCE. The one concrete allegation against the President, concerning an account purportedly held in his name at a U.S. bank, was demonstrably false. As head of FIFA, however, President Blatter bears some responsibility for a flawed process that engendered deep public skepticism, and for presiding over an Executive Committee whose culture of entitlement contributed to many of the issues this Report identifies.

Fraud examiners argue that Blatter must take responsibility for the failures that occurred on his watch. He made himself accessible on a selective basis, giving the impression that individuals such as Peter Hargitay were insiders afforded preferential treatment, including freedom to speak to high-ranking Fifa officials about inappropriate topics, such as quality of competing bids, in a manner that was not tolerated by others. Hargitay was in the business of lobbying and campaign strategies. He worked as a consultant to several of the nine bidding teams composed of eleven different countries.

Private Policing Evaluation

A review of the investigation report by Garcia (2014) requires evaluation criteria according to the maturity model for private policing in fraud examinations as illustrated in Figure 7. We place the Fifa investigation by Garcia (2014) at level 3 of disclosure in the figure. The desire by powerful Fifa people to keep the investigation report secret is evidence of disclosure of misconduct and potential crime that Fifa executives did not want to leak out to governments, the media, and the public in general. The Garcia (2014) report deserves no better evaluation, as there is no real clarification of roles and responsibilities, and there seems to be no learning or other aspects of investment from the report.

Figure 7. Maturity model for internal private investigations applied to Garcia

Fraud examiners did not succeed in achieving cooperation with important informants. Fraud examiners thus failed, probably because they were confrontational rather than cooperative in their attempts to talk to informants. As mentioned above, there might have been acceptable reasons why executive committee members such as Beckenbauer and Llona did not cooperate with the investigators. If Garcia and the other examiners had approached suspects and witnesses in a more professional manner, they might have succeeded in obtaining relevant and complete statements. Based on their failure to interview informants, the Garcia (2014) investigation has similarities with criteria at level two in the maturity model in Figure 7, as the process of private policing resembled a mess. However, since they succeeded in disclosing new information, the investigation remains at level 3 in the model.

Case 3: Oceanteam services by Sands

The background for this private policing of suspected economic crime in terms of an internal investigation by fraud examiners is slightly different from most others, where the organizations themselves initiated investigations. In 2016, one of the minority shareholders in Oceanteam requested an investigation in accordance with chapter 5 of the Norwegian public limited liability company act. Bergen district court ruled in favor of the demand from the minority shareholder. Oceanteam appealed the ruling. However, in 2018, Gulating court of appeal ruled in accordance with the Bergen district court ruling. Subsequently, lawyer and partner Nicolai Skridshol at the law firm Sands received a request from the court to carry out the investigation. The courts stated the mandate for the assignment given to Sands (2019a, 2019b)) in their rulings.

Oceanteam (OT) provided support for offshore contractors all over the world through its fleet of large offshore vessels and its expertise in marine equipment, cable logistics, and design engineering. Chief executive Haico Halbesma, chief executive, Hessel Halbesma, chairperson, as well as three board members, faced accusations of fraud against Oceanteam.

White-collar convenience

Assuming the allegations are correct, we briefly study the alleged white-collar crime by application of convenience theory. The chief executive and board members were obviously greedy. Greed implies that offenders are never satisfied, as they always want more profit money (Goldstraw-White, 2012). The chief executive and board members had status and access (Benson & Simpson, 2018; Cohen & Felson, 1979). Furthermore, it seems that the two Halbesma suffered from narcissistic identification with the organization. Narcissistic identification is a special type of narcissism, where the offender sees little or no difference between self and the corporation. The company money is personal money that can be spent whatever way the narcissist prefers (Galvin et al., 2015). While grandiosity and admiration belong to the motivational dimension of convenience theory, empathy deficit belongs to the willingness dimension of convenience theory where the offender possesses a sense of entitlement (Nichol, 2019). The offender shows unreasonable expectations to receive and obtain preferential treatments (Zvi & Elaad, 2018). Figure 8 illustrates narcissistic identification along the axis willingness-choice-identity.

Figure 8. Convenience themes in the case of Oceanteam

Fraud examination outcome

Sands (2019a) found that in general, fraud examiners observed an extensive lack of control of invoices and timesheets from executives and board members. Relevant functions had not controlled board members’ timesheets, and the same applied to the CEO. For example, in 2015, Hessel Halbesma invoiced 3.600 additional hours of a total of EUR 1,080,000. Travel bills and other remunerations were extremely high. For example, Hessel Halbesma had travel expenses of EUR 333.000 in 2013 (Sands, 2019a, p. 9):

In our review of Hessel Halbesma’s travel bills, several expenses classified as company expenses, appear highly questionable with regards to being associated with OT’s daily operations, for example, purchases of clothing, numerous toll road passings, travels to places where OT has no operations (e.g. Verbier, San Remo), helicopter rental expenses in Monaco and dining expenses with no information about participants, the purpose of the meal or the relation to OT’s operations.

Fraud examiners drew similar conclusions regarding Haico Halbesma’s travel bills, where several expenses appeared unrelated to Oceanteam’s business. Art purchases, sponsorship of a Mexican artist, boat purchase in Monaco, and a personal legal dispute are some of the additional examples presented in the report by Sands (2019a).

Fraud examiners conclude in their report on related party transactions such as fees, salaries, and incentives, travels, and remunerations. Other relevant findings and transactions include art purchases (Sands, 2019a, p. 176):

We have been informed that Halbesmas allegedly bought art paid by OT (Oceanteam) for private use. However, OT states that they possessed and are still in possession of the art, and that the purchases are registered in B.V. (.) It therefore remains unclear whether OT is in possession of all art specified in the financial account.

It seems surprising that fraud examiners were unable to conclude on this issue. Similarly, fraud examiners failed in concluding whether boat purchases in Monaco and sponsorship of Mexican artist were corporate expenditures or private expenditures paid by the corporation. Yet another example of lacking conclusion is Halbesmas’ legal dispute with another party, which Oceanteam paid for (Sands, 2019a, p. 180):

Through interviews, we have received various information about what and who this dispute concerns. Both Haico Halbesma and OT’s corporate counsel describe the legal matter and the parties involved imprecisely in their interviews and not correctly compared with the legal documents.

The final issue in the factual report is the nomination and remuneration committee. Minority shareholders Storm Capital and Otterley Group had requested such a committee to be established. Over a long period, the shareholders followed up on the matter, but such a committee was never established. Again, fraud examiners fail to conclude on the matter.

Private policing evaluation

It seems that Sands’ fraud examiners have done a thorough investigation by reconstructing past events and sequences of events related to privileged individuals’ abuse of positions at Oceanteam for personal gain. The private policing by Sands (2019a, 2019b) thus deserves an allocation at least at level four in the maturity model in Figure 9. Since there was continued dispute after the release of the report, the investment level is not obvious. In fact, after the release of the report to Bergen district court, Halbesma, and others attempted to prevent shareholders to access the report. While the report was completed and submitted to the court on 4 November 2019, the secrecy went on until April 2020, when a shareholders meeting needed the report. Oceanteam then decided to make the report public on their website, commenting that they were not responsible for the contents.

Figure 9. Maturity model for internal private investigations applied to Sands

A letter sent to all shareholders of Oceanteam on 30 March 2020 illustrates the dispute, dissatisfaction, and reluctance to distribute the private policing report, as the letter emphasizes the lack of trust that major shareholders and the company places in the report by Skridshol’s team:

Following a joint petition from the company and the investigation requester, on 4 October 2019, the Bergen district court made a decision to cease the ongoing investigation. In the decision it was further resolved that the investigation report, as far as the report had been written at the time the decision was legally binding, was to be submitted to the Bergen district court.

In accordance with the Public Limited Companies Act section 5-28 second paragraph the Bergen district court convenes the EGM (extraordinary general meeting) to deal with the investigation report (…)

The investigation report has been prepared solely by the investigator, Mr. Nicolai Skridshol, and his investigation team, and the company is not liable for the content of the report. The report was not presented to Oceanteam for review and clarification before being submitted to the court, and the company has not taken any position with respect to the correctness of the factual or legal circumstances described in the report. Oceanteam is in the process of evaluating the report and the company’s legal position.

An interesting approach applied by the fraud examiners was to distinguish in their report between a factual review (Sands, 2019a) and a legal review (Sands, 2019b). The legal review was required in the mandate (Sands, 2019b, p. 2):

Legal assessment of the facts, including assessment of whether the mapped transactions violate the provisions of the Public Limited Liability Companies Act on related transactions.

Fraud examiner Skridshol and his team focused on three legal topics: abuse of position, invalidity of agreements due to lack of shareholder approval, and unlawful distributions on the part of Hessel and Haico Halbesma. They identified a number of agreements, transactions, and matters that in their view constitute likely unlawful distributions. Attempts to charge for services not delivered, as well as any other invoices for services not delivered or use of company funds to pay private expenses, can potentially constitute violations of provisions in the penal code.

Case 4: moldova banks by Kroll

This case study is concerned with an internal investigation by fraud examiners in Moldova banks that the National Bank of Moldova initiated. On 28 January 2015, the National Bank of Moldova (NBM) engaged forensics firm Kroll (2016) to conduct a scoping phase of investigation into certain transactions involving Banca de Economii, Banca Sociala, and BC Unibank in Moldova. The Republic of Moldova is a landlocked country in Eastern Europa, bordered by Romania and Ukraine. Kroll is a UK-based firm that conducts investigations.

The New York Times reported in October 2015 that Moldova ‘was rocked this year by the discovery that 1 USD billion had fraudulently siphoned from Moldova’s banking system over a period of years, a huge amount for an impoverished country whose entire economic output is only about 8 USD billion a year’ (Nechepurenko, 2015). Financial Times reported in January 2016, that, ‘until the fraud came to light last year, Moldova was considered a rare success in the EU’s campaign to build bridges to post-Soviet states’.

In 2017, Kroll (2017) was again working for the National Bank of Moldova (NBM) to evidence what caused the three Moldovan banks to collapse, to understand who perpetrated and benefitted from the fraud and to support criminal and/or civil proceedings to recover the misappropriated funds. One billion dollars had disappeared from the banks in a coordinate effort. Ilan Shor, a 28-year-old Moldovan business executive and the mayor of Orhei, organized the swindle. Shor was chairperson of the board of Banca de Economii.

The Times of Israel reported in 2019 that Ilan Shor was sentenced to 7.5 years for fraud and money laundering (Iordachescu & Rodina, 2019; Liphshiz, 2019). Kroll’s (2016) scoping phase report found evidence that suggested that Ilan Shor, and companies and individuals affiliated with him (the ‘Shor Group’), played an integral role in coordinating the illegal financial transactions. Kroll (2017) developed further evidence of Shor’s involvement leading to his conviction.

The Guardian reported in 2015 that Grant Thornton, the UK-based accountancy firm with local offices in many countries, was the auditor for the three Moldovan banks through which the money was embezzled and spirited out of the country in complex financial transactions. Investigators accused auditing firm Grant Thornton of negligence and incompetence after 1 USD billion disappeared out of Moldova, a sum equivalent to 15% of the country’s gross national product (Rosca, 2015).

White-collar convenience

Assuming the allegations are correct, we briefly study the alleged white-collar crime by application of convenience theory. The motive was both individual and corporate gain based on possibilities to commit bank fraud, as illustrated in Figure 10. Probably, involved individuals wanted to climb the hierarchy of needs for status and success (Maslow, 1943) and realize the American dream of prosperity (Schoepfer & Piquero, 2006). In addition, they wanted their businesses to make as much profit as possible (Naylor, 2003) and reach business objectives that justify means (Jonnergård et al., 2010).

Figure 10. Convenience themes in the case of Moldovan banks

In the opportunity dimension of convenience theory, Moldovan banks obviously lacked guardianship, control mechanisms, and professional audit functions. There was decay by institutional deterioration (Rodriguez et al., 2005), inability to control because of social disorganization (Hoffmann, 2003), and misrepresentation in accounting (Qiu & Slezak, 2019) – in addition to the status of the offenders in the elite (Pontell et al., 2014).

Elite members in Moldova involved in the bank fraud did it on purpose as a rational choice where perceptions of benefits exceed costs (Pratt & Cullen, 2005). There was probably a behavioral reinforcement of deviance over time (Benartzi et al., 2017), and offenders learned from each other by differential association (Sutherland, 1983). A collectivist value orientation emerged among offenders (Bussmann et al., 2018), where they perceived no deterrence effect (Comey, 2009).

Fraud examination outcome

The mandate for the investigation was to reconstruct events and sequences of events to provide insights into financial irregularities, the main suspect parties, and the roles and responsibilities, In particular, investigators should identify events leading to the collapse of three banks and identify beneficiary of funds that had disappeared from the three banks. The main source of information was NBM.

Fraud examiners from Kroll reviewed transactions from 2012 to 2014 in the three Moldovan banks. The banks were consecutively subject to significant shareholder changes, which had the effect of transferring ownership to a series of apparently unconnected individuals and entities. Each bank entered into a series of transactions resulting in such a significant deterioration in each of their balance sheets that they no longer were viable as going concerns. It was bankruptcy in 2014 in all three banks that triggered the fraud examination.

Fraud examiners established that important bank files were missing. They did not believe the story told them that someone had stolen and burned down a car with bank files (Kroll, 2016, p. 67):

The order was communicated to relevant department heads and 12 sacks of files were transferred to Birca’s office. Iurie Buruiana, head of BEM’s department for management, collection, and technical protection, was tasked with procuring a vehicle to transport the files to the archive. A vehicle was provided at 7pm on 26 November by Klassica Force SRL, a security which BEM staff has stated is controlled by Ilan Shor. The sacks were loaded into the vehicle by the driver under the supervision of Iurie Buriana. As it was late, the driver stated that the documents would be transported to the archive the following day, on the 27^th, and the vehicle would be held in a secure garage overnight. The following day, Klassica Force SRL informed BEM that the vehicle had been stolen and found burned out, a fact confirmed by a Moldovan police report issued on 1 December 2014.

Fraud examiners suggested the following events leading to the collapse of the banks. First, between January and November 2014, exposure of companies deemed directly and indirectly linked to Ilan Shor increased by MDL three billions to almost MDL eight billions. The fact that almost all of this exposure was concentrated in the three banks cannot be a coincidence. Funding of this explosive loan activity was largely through interbank deposits between the banks.

Second, transactions within each of the three banks had an appearance of lending to related parties to each of them, where the explosive lending activity developed its own dynamics.

Third, such a significant level of interrelated lending with three, apparently independent banks would have required a significant level of coordination. Significant connectivity between the shareholders of each of the banks as well as the number of common management changes between the banks could explain the co-ordination.

Fourth, such extended and interrelated funding and loan activity within and between the three banks culminated in a series of events in November 2014, which indicate that this was no longer sustainable. The majority of lending seemed like a routinized activity, facilitated by interbank deposits from Moldovan and Russian banks. Analysis of loan transactions reflects a clear pattern of lending within each bank, finding repayment by loans issued to entities in another bank, via the passing of funds through Russian banks, Latvian bank accounts, and UK limited partnerships.

Fifth, a series of highly unusual events took place on 28 November 2014, at the same time as new loans flowed out of banks, which were further indicative of efforts to extract the maximum value of funds possible from the banks before they collapsed.

Finally, as quoted above, Moldovan police destroyed evidence and reported the loss on December 1.

Private policing evaluation

In their second report, Kroll (2017, p. 20) admits that they failed in interviewing the main suspect Ilan Shor, and they failed in obtaining a verifiable statement from him, which is an obvious shortcoming of the investigation:

Kroll was made aware of the existence of a statement that has been uploaded onto the internet, which purports to be Mr. Shor’s statement to the Public Prosecutor, providing an explanation for some of the events that took place within the Three Moldovan Banks. Kroll has not been provided with an official copy of Mr. Shor’s statement and has not had the opportunity to meet with Mr. Shor. As such we are not at this stage in a position to confirm the authenticity of the document and do not comment on its content within this report.

The quoted statement seems arrogant and ignoring criminal justice, where everyone is innocent until proven guilty. Furthermore, fraud examiners should have listened to and respected statements from a suspect, since everyone is innocent until proven guilty, and not ignored as seems to be the case by fraud examiners from Kroll. Therefore, we consider their two investigations far from perfect. A professional crime investigation is about not only what you find out but also how you did it, and how you treated suspects and witnesses in the process.

Fraud examiners relied too heavily on information from NBM, especially in the first investigation (Kroll, 2016, p. 7):

In conducting this preliminary scoping phase of investigation, Kroll has relied upon information and analysis conducted by NBM, in order to conduct an assessment of the basis of their findings to date, and concerns raised.

Nevertheless, we place the Kroll (2016, 2017) reports at the clarification level 4 in the maturity model in Figure 11.

Figure 11. Maturity model for internal private investigations applied to Kroll

Conclusion

When there is suspicion of economic crime by white-collar offenders in organizations, the organizations tend to hire fraud examiners to conduct private policing by internal investigations in the organizations. The affected organizations become clients of law firms and auditing firms who reconstruct past events and sequences of events to determine the extent of misconduct and crime. This article has presented a few relevant case studies to illustrate the extent of convenience in white-collar crime and the level of maturity in fraud examinations. Overall, most internal investigators have a long way to go before their work deserves the classification of an investment for the clients. Failing interviews, lack of relevant knowledge, and conclusions without reliable evidence are some of the shortcomings identified in the case studies. As pointed out in previous research (e.g. Brooks & Button, 2011; Button et al., 2007a; Button & Gee, 2013; Button et al., 2007b; P. Gottschalk, 2020; Schneider, 2006; Williams, 2005), many fraud examiners have a long way to go before they can deserve the label professional investigators or examiners. Future research may help professionalize the business of private policing of economic crime.

Disclosure statement

No potential conflict of interest was reported by the author.

Additional information

Notes on contributors

Petter Gottschalk

Petter Gottschalk is a professor in the Department of Leadership and Organizational Behavior at BI Norwegian Business School in Oslo, Norway. After completing his education at Technische Universität Berlin, Dartmouth College, MIT, and Henley Management College, he took on executive positions in technology enterprises for 20 years before joining academics. Dr. Gottschalk has published extensively on knowledge management, intelligence strategy, police investigations, white-collar crime, convenience theory, and fraud examinations. He has lectured in the United States, China, Singapore, and Egypt.