«They don't touch anything!» That is the first thing that experts in internal research tell their clients when they are called to require them to track to the bowels of their businesses after detecting an irregularity. The simple ignition of an electronic device can cause the modification of information as basic as the date of last access to a file, which can later be a lock in a trial. The companies hire these specialized services, as if it were police, which usually provide the great professional services firms for the need to have their sophisticated technological equipment and computer programs to clarify what has happened within a company at a given time. The cases of large companies that have used the result of these inquiries to dodge an eventual criminal responsibility are known, as BBVA and Iberdrola did after splashing the Villarejo case, which trusted PWC for it. But these works are also required to avoid running with new surprises in half key processes such as refinancing. That was the case of Dia, who asked Ey to dive in his accounts; Deloitte, which detected a «possible counterfeit falsification» in EIDF, at a time when the renewable company was going through a tough financial situation; or KPMG, which revealed that in Pescanova the financial results had been manipulated. Not only the Big Four perform these forensic services; Large consultants also have specialized equipment to follow the track of possible cases of fraud, corruption, cash outputs, misappropriation, accounting manipulation, unfair competition, conflict of interest or other types of internal or not very ethical illegal practices. The first steps of the Forensic were given in 2000, when the Civil Procedure Law (LEC) was reformed, which opened the door to the expert reports of part. Until then, these analyzes could only be requested by the judges to understand facts of those who have no specialized knowledge. The boom came in 2015, when it was introduced into the Criminal Procedure Law (LECrim) the possibility that companies were exempt from criminal responsibility if they have a criminal risk prevention plan. So, internal investigations, which are commissioned by the department departments (regulatory compliance), legal advice or auditing of companies, even by senior management or external lawyers, they are destined to debug Internal responsibilities or try to free companies to respond criminally to the infractions committed by their employees. For this, Forensic teams are multidisciplinary composed of economists, graduates in Business Administration and Directorate Grant Thornton. From KPMG they also emphasize this difference: “They are hardly related. A financial audit is limited to reviewing the company's financial statements or the annual accounts prepared An ad hoc work that analyzes in depth concrete aspects that has rarely to do with accounting issues. «
Research with all guarantees
In any case, investigations must be carried out with all guarantees, as well as police or judicial investigations. In fact, they meet similar procedures in the overtions and seized of the information of electronic devices. Grant Thornton is one of the signatures that has a laboratory from which experts explore all the documents collected from the company or the investigated worker, under strict controls to avoid any type of manipulation. «The devices are the richest source of information for investigations. Digital evidence is like the knife of a crime where you can find traces,» Cristina Muñoz-Aycuens, Forensic partner and cybersecurity of said consultant exemplifies. The members of the Forensic area of Grant Thornton, Alfonso Bravo and Cristina Muñoz-Aycuens, in the 'laboratory' of the consultant where they carry out the internal investigations of companies. Image assigned by the firm. As KPMG explains, professionals work with Forensic copies, «which cannot be modified and function as a fixed photo» and whose evidence can be «provided later in potential judicial processes as valid tests.» Therefore, adds the partner of Grant Thornton, «it is also the weakest test because it is the easiest to attack in trial», because it can always be questioned if the chain of custody has been maintained, if their obtaining has incurred violations of rights, or if your treatment has been correct. The first thing that is usually checked, explains Muñoz-Aycuens, is whether the company that requires research has a policy for the use of corporate systems, which defines the access and use of its computer resources, and check if it specifies that the property of the devices is of the company, if it gives limits to the personal use of the employee, and if there is the possibility of monitoring. It is not necessary for this policy to be signed by the employees, the consultancy's partner specifies, but that «it simply has to be known, either by the intranet, email or notices before the use of the computer.» And in case these rules do not exist, the forensic copy must be made before a notary or subsequently deposit it before the public feeder to ensure that it has been carried out in compliance with all the rules and guarantees, he points out.
Interviews and communications tracking
With this, research is launched and touches the research strategy. «The first decisions are key because they can condition in the future. The problem is hurry to know what has happened,» says Alfonso Bravo. The works are usually very varied but, in general, they usually include interviews with workers or people linked to the organization, electronic communications reviews through the keywords to know which members of the workforce, intermediate levels, even of the Board of Directors and Senior Management were aware of the facts investigated and thus know the alleged authors or accomplices. Likewise, some of these investigations also imply the analysis of the treasury and cash output to find out if there has been capital escape, irregular contracts or corruption cases. «You always have to be proportional to what is being investigated, but the investigation is something alive and there you must make more decisions. First you cannot interview everyone, but must be giving to the established investigation perimeter. If indications are then collected, this can be expanded,» concludes Cristina Muñoz-Aycuens.
