Forensic Accounting & Red Flags: Detecting Fraud & Manipulation

Introduction: The Forensic Mindset

Financial fraud is easier than it seems. Companies commit fraud because:

1. Pressures to beat targets (CEO's bonus, stock option vesting, debt covenants)

2. Rationalization ("This is temporary; we'll make it back next quarter")

3. Opportunity (complex accounting, weak auditors, trusting boards)

The forensic mindset: Assume nothing. Trust the footnotes, not the headlines. A company's CFO has incentive to inflate reported earnings. Your job is to audit the auditor.

Forensic Accounting Mission Forensic accounting is detective work: searching financial statements for evidence of manipulation, fraud, or aggressive accounting that overstates reported earnings. The goal is to estimate "normalized" earnings (what earnings would be if accounting were conservative).

The three most common areas of fraud:

• Revenue recognition (40-50% of restatements)

• Capitalization vs expensing (20-30%)

• Reserves and provisions (10-20%)

Part 1: Revenue Manipulation Techniques

Revenue is the easiest thing to manipulate because sales involve customer judgment ("Is this really a sale?") and timing ("Which quarter does this belong in?").

Technique 1: Channel Stuffing

Definition: Selling excess inventory to distributors/wholesalers at the end of the quarter, even though the company knows much of it will be returned.

Red flags:

• Sales spike at quarter-end

• Days Sales Outstanding (DSO) increases

• Return rate increasing

• Distributors' inventory levels too high

Real example: Valeant Pharmaceuticals (2014-2015)

Valeant's Philodendron specialty pharmaceutical business inflated sales by forcing pharmaceutical distributors (Walgreens, Pharmacy Benefit Managers) to buy excess inventory:

Manipulation mechanics:

• Q4 2014: Offered special pricing/terms to distributors to buy inventory

• Recognized full revenue in Q4 2014, but distributors didn't actually need inventory

• Q1 2015: Inventory returned/not sold, so sales had to be restated

• Meanwhile: Stock price inflated by fraudulent Q4 revenue, executives sold shares at peak

Forensic detection:

• DSR (Days Sales in Receivables): 62 days (2014) → 103 days (2015) = DSRI 1.66 (red flag >1.465)

• Distributor inventory levels: Public filings showed inventory piling up

• Return rates: Post-restatement, returns jumped to 25%+ (abnormal)

• Beneish M-Score: Would have flagged this as high manipulation probability

Stock performance:

• Peak: $260 (2015)

• Founder Pearson arrested and convicted

• Stock: $20 (2024), company restructured

How to detect channel stuffing:

1. Calculate DSR (Days Sales in Receivables) and trend it

2. Track distributor inventory levels (sometimes disclosed in MD&A)

3. Calculate DSR index (DSRI from Beneish M-Score); DSRI >1.465 is red flag

4. Interview management: "What is your return rate? Have any terms changed?"

5. Look for "soft" language in MD&A: "subject to approval," "right to return"

Technique 2: Bill-and-Hold

Definition: Customer "buys" goods, company recognizes revenue, but shipment is delayed (sometimes months). Goods sit in company warehouse or customer warehouse awaiting delivery.

Red flags:

• Revenue increasing while shipments flat or declining

• Goods in "channel" or "on approval" mentioned in footnotes

• Inventory rising despite higher sales

• Customer disputes/allowances increasing

Real example: MiniScribe (1980s hard drive company)

MiniScribe's auditor (Coopers & Lybrand) discovered:

• Company recognized revenue on 2M disk drives "sold" to distributors

• Drives were shipped to third-party warehouses, not customer sites

• Drives were never actually ordered by end customers

• When fraud discovered, MiniScribe stock collapsed and company went bankrupt

Forensic detection:

• Inventory-to-sales ratio: Normally flat, would have been rising

• Revenue from distributor channel vs end-user channel: Distributor suddenly 60%+ of sales

• Gross margin by customer: Distributor margins were abnormal (lower than expected)

• Physical verification: An auditor visiting warehouses could have found goods

How to detect bill-and-hold:

1. Track inventory levels relative to sales (if sales up 20%, inventory should be down 10-20%, not up)

2. Ask about "channel stuffing" or "bill-and-hold": Management should give straight answer

3. Look for footnote disclosures about goods "on approval" or "in channel"

4. Calculate inventory turnover trend; declining turns suggests goods stuck in channel

5. For major customers: Ask if any large orders are "subject to return" or "warehouse" shipments

Technique 3: Round-Tripping

Definition: Company A sells inventory to Company B, then Company B sells identical inventory back to Company A at similar price (or higher). Both companies recognize revenue, but no real transaction occurred.

Red flags:

• Sales to related parties (subsidiaries, joint ventures)

• Unusual customers appearing in big deals

• Related party transactions buried in footnotes

• Sales to customers that don't seem economically viable

Real example: Enron (related party transactions)

Enron used special purpose entities (SPEs) to round-trip transactions:

1. Enron sells natural gas pipeline rights to SPE "LJM"

2. Enron recognizes revenue on sale

3. SPE immediately sells rights back to another Enron SPE

4. Both transactions booked as revenue, but no cash changed hands outside the Enron ecosystem

Financial impact:

• $6.2B in fictitious revenue recognized

• $1.3B in "profits" entirely from round-tripping and mark-to-market

Forensic detection:

• Review related party transactions: What percentage of sales go to related parties?

• Enron: ~40% of "revenue" came from related parties (massive red flag)

• Ask: What was the economic purpose? (In Enron case, there was none-pure accounting entry)

• Verify customer creditworthiness: If major customer is unknown company, red flag

How to detect round-tripping:

1. Identify all related party transactions (Note 15 or similar: Related Party Transactions)

2. Calculate % of revenue from related parties; >5% is red flag, >10% is danger zone

3. For each related party transaction, understand economic purpose

4. Track if same product/inventory is sold back and forth multiple times

5. Verify nature of "related party": Subsidiary? Joint venture? Undisclosed family member? Stock options for executives?

Technique 4: Percentage-of-Completion Abuse (Long-Term Contracts)

Definition: For multi-year contracts (construction, defense, software), company recognizes revenue based on % completion estimate. Inflating completion % = inflating revenue.

Red flags:

• Large long-term contracts (>1 year)

• Completion % estimates frequently revised upward

• Project delays, but revenue still recognized

• Gross margin on projects higher than historical norms

Real example: Nortel Networks (1998-2004)

Nortel used percentage-of-completion accounting for telecom contracts. To inflate revenue:

• Estimated contract completion % artificially high

• Revised estimates upward mid-project without objective justification

• Recognized revenue that would later be reversed when projects completed

Financial impact:

• Overestimated revenue by $5B+ over several years

• Stock collapsed from $80 → $0.50 when contract revenue couldn't be sustained

• Bankruptcy filed 2009; shareholders wiped out

Forensic detection:

• Calculate revenue per contract vs actual labor hours (if disclosed)

• Track if completion % estimates are revised upward frequently

• Compare gross margin by contract to company historical average

• Verify project milestones are objectively measurable

How to detect percentage-of-completion abuse:

1. Find Note on Revenue Recognition (typically Note 1 or 2)

2. For long-term contracts: What % of revenue is percentage-of-completion vs completed?

3. Track if % completed revisions tend to be upward or downward

4. Compare cumulative revenue recognized vs cash collected (if lag >6 months, red flag)

5. Interview management: "What objective criteria do you use for % completion?" (Good answer: objective milestones. Bad answer: "our estimate")

Part 2: Expense Manipulation

Managing expenses is easier than managing revenue because expenses are often estimated (accrual accounting).

Technique 1: Capitalizing Operating Expenses (Improper Capitalization)

Definition: Instead of expensing a cost immediately (reducing earnings), capitalize it as an "asset" and depreciate/amortize over multiple years, spreading cost across many periods.

Red flags:

• Asset base growing faster than sales or capital expenditure

• Depreciation/amortization ratio declining

• Changes in capitalization policy (longer useful lives)

• Software, marketing, or other non-capital assets suddenly being "capitalized"

Real example: WorldCom (2002)

WorldCom capitalized routine operating expenses (line costs) as assets:

Normal accounting:

• Telecom company pays other carriers $15B annually for "line costs" (network access)

• Under normal accounting: expense immediately, reduce earnings by $15B

• Reported earnings: (Revenue - Expenses) = (Revenue - $15B line costs)

WorldCom's fraud:

• Instead of expensing line costs, capitalized them as "prepaid expenses" or "assets"

• Depreciated them over 5 years instead of expensing in year 1

• Effect: Reported earnings artificially inflated by $3-4B annually

CEO Bernie Ebbers' motivation:

• Stock price needed to stay above $5 to avoid debt covenants

• Had personal loans backed by WorldCom stock, so stock crash = personal bankruptcy

• Fraudulently capitalized expenses to meet targets and keep stock price up

Forensic detection:

• D&A (Depreciation & Amortization) to Revenue ratio declining

• Capital expenditures reported in cash flow, but not matching PP&E growth

• Compare to peers: If WorldCom's D&A % was 3% of revenue vs peers 8-10%, red flag

• Read footnotes: Any mention of "capitalized" line costs or unusual assets?

Impact:

• $11B in fictitious earnings

• Stock collapsed from $65 → bankruptcy

• Ebbers convicted of fraud, sentenced to 25 years

• Shareholders lost $180B+ in market cap

How to detect improper capitalization:

1. Calculate asset growth rate vs sales growth rate (if assets growing 2x faster, red flag)

2. Track depreciation policy changes (management disclosures in 10-K)

3. Compare D&A/Revenue ratio to peers

4. Examine asset categories for unusual items (should be property, plant, equipment, not "other assets")

5. Read footnotes: Any mention of changes in useful lives or capitalization policy?

Technique 2: Cookie-Jar Reserves (Income Smoothing)

Definition: In good years, create large reserves (accruals) for potential future losses. In bad years, reverse reserves and boost earnings.

Red flags:

• Reserves increasing during peak earnings years

• Reserves reversed during down years

• Reserve balances seem disproportionate to risk

• Write-downs/reversals not explained in MD&A

Real example: Enron (reserve manipulation)

Enron's "mark-to-market" accounting allowed estimated future profits to be recognized as present earnings. Management then:

• In good years: Created large "loss reserves" for perceived risks

• In bad years: Reversed reserves (reducing expenses) and inflated earnings

Effect:

• Reported earnings appeared smooth (no quarterly volatility)

• Actual business was increasingly stressed

How to detect cookie-jar reserves:

1. Track reserve balances over time (Allowance for Doubtful Accounts, Warranty Reserves, etc.)

2. Compare reserve reversals to new reserves accrued

3. If reversals > new accruals in recent year, company may be using reserves to smooth earnings

4. Calculate reserve levels relative to underlying risks (e.g., Doubtful Accounts should be ~2-5% of receivables)

5. Read MD&A: Management should explain reserve changes clearly

Technique 3: One-Time Charges & Restructuring Abuse

Definition: Management takes large one-time charges in quarters when earnings are already weak, hiding ongoing operating problems. Or, recurring expenses are labeled as "one-time," so "adjusted EBITDA" excludes them.

Red flags:

• Large "one-time" charges every few years (if recurring, it's not one-time)

• Adjusted EBITDA significantly higher than GAAP earnings

• Restructuring charges for same division multiple times

• Management emphasis on "normalized" or "adjusted" earnings (excluding bad items)

Real example: GE under Jeff Immelt (2000-2015)

GE took large restructuring charges almost annually, claiming they were "one-time." Effects:

• Distracted from declining operational earnings

• Made prior-year "normalized" earnings look better by comparison

• Stock underperformed for 15 years despite seemingly good "adjusted" earnings

How to detect restructuring abuse:

1. Count "one-time" charges over past 10 years; if >3, they're not one-time

2. Track if same division has restructuring charges repeatedly

3. Compare GAAP earnings to "Adjusted EBITDA"; if gap >20%, large red flag

4. Categorize one-time charges: Some are legitimate (discontinued business). Others are suspicious (same restructuring every year).

5. Ask: If this is really a "one-time" event, why does management need to "adjust" it away from reported earnings?

Part 3: Cash Flow Manipulation

Cash flow is harder to manipulate than earnings (because it's based on actual cash movements), but still possible.

Technique 1: Factoring Receivables

Definition: Company "sells" receivables to a financial institution at a discount, immediately getting cash. But if contract terms allow company to buy them back or absorb losses, the transaction is not really a sale.

Red flags:

• Receivables declining while sales increasing (impossible-sales should create receivables)

• Large factoring or financing activities in cash flow statement

• Customer concentrations increasing (if customers can't be factored, company can't use this trick)

Real example: Lehman Brothers (pre-2008 collapse)

Lehman used "Repo 105" to move assets off balance sheet:

• Sold securities to a financial institution

• Simultaneously agreed to buy them back at slightly higher price

• Net effect: Cash in, but securities back on balance sheet

• From auditor's perspective: Looked like a sale (reducing debt), not a loan

• Reality: Lehman had hidden $50B in debt

How to detect receivables factoring:

1. Track Accounts Receivable relative to sales (DSO should be relatively stable)

2. Look for "factoring" or "securitization" mentioned in cash flow statement

3. Compare operating cash flow to net income; if OCF << NI, possible factoring (earnings quality issue)

4. Read footnotes on customer concentrations: If dominated by few customers, factoring may not be available

Technique 2: Stretching Payables (Delaying Payments)

Definition: Delaying payments to suppliers extends cash runway, inflating operating cash flow in the short term.

Red flags:

• Days Payable Outstanding (DPO) increasing

• Accounts Payable rising while Revenue flat

• Supplier conflicts mentioned in MD&A or conference calls

• Credit rating downgrades

Real example: Toys "R" Us (2000s)

To preserve cash, Toys "R" Us delayed supplier payments:

• Extended payment terms from Net 60 to Net 90+

• Inventory suppliers (Mattel, LEGO) extended credit reluctantly

• Effect: Improved cash flow on paper, but suppliers lost confidence

• Reality: Suppliers eventually demanded cash-on-delivery or stopped supply

• Business failed when supplier relationships broke down

How to detect stretched payables:

1. Calculate Days Payable Outstanding (DPO) and trend it

2. If DPO increasing significantly (>20% year-over-year), red flag

3. Compare to industry average; if 30 days higher than peers, concerning

4. Read MD&A: Any mention of supplier relationships or extended payment terms?

5. Monitor news: Supply disruptions or supplier complaints signal stressed relations

Technique 3: Reclassifying Investing Cash Flow as Operating

Definition: Sale of assets (land, subsidiary, investments) classified as "operating activities" instead of "investing activities." Effect: Operating cash flow inflated, but company isn't actually generating cash from operations.

Red flags:

• Operating cash flow high, but cap-ex declining (inconsistent)

• Gains on asset sales increasing

• Investing cash flow from sales of assets (not financing activities)

How to detect cash flow reclassification:

1. Compare OCF to CapEx: If OCF high but capex declining, where is cash coming from?

2. Review "Investing Activities" section: Look for asset sales, subsidiary sales, investment sales

3. Calculate recurring OCF (exclude one-time asset sales) vs reported OCF

4. If large difference, company's actual operating cash generation is weaker than reported

Part 4: Off-Balance-Sheet Accounting

The most sophisticated frauds hide obligations off the balance sheet entirely.

Technique 1: Special Purpose Entities (SPEs)

Definition: Company creates a separate legal entity (often with complex ownership structure) to own assets or liabilities. If structured correctly (from accounting perspective), SPE doesn't need to be consolidated, hiding debt/losses.

Red flags:

• SPE or special purpose entity mentioned in footnotes

• Related party transactions to entities that aren't consolidated

• Management or board members have stakes in SPEs

• SPEs used for "financing" or "hedging"

Real example: Enron (SPE empire)

Enron created 3,000+ SPEs, including:

• LJM (managed by CFO Andrew Fastow)

• Chewco (managed by Fastow's protégé)

• Jedi (others)

Purpose: Hide debt and mark-to-market losses

• Enron "sold" assets to SPEs, recognizing gains

• SPEs financed purchases using debt (Enron guaranteed debt)

• SPEs didn't appear consolidated, hiding debt from investors

• When assets declined in value, SPEs held losses off-balance-sheet

Financial damage:

• $30B in off-balance-sheet debt hidden

• $1.3B in fake gains from SPE transactions

• Stock collapsed from $90 → bankruptcy

How to detect SPE risks:

1. Read Note 1 (Consolidation Policy) carefully: Which entities are consolidated, which are not?

2. Identify all unconsolidated entities; understand why they're not consolidated

3. Track SPE debt: Can parent company be forced to absorb losses?

4. Assess management incentives: Do executives benefit from SPE structures?

5. For Enron: SPEs were managed by executives (red flag #1), non-consolidated (red flag #2), used to hide losses (red flag #3)

Technique 2: Operating Leases (Pre-ASC 842)

Definition: Before 2019 accounting rule (ASC 842), operating leases didn't appear on balance sheet. Company could rent factories/equipment, recording only rent expense, but hiding the obligation.

Red flags (relevant for pre-2019 analysis):

• Large operating lease commitments disclosed in footnotes

• Operating rent expense high vs peers

• Debt-to-equity artificially low because leases aren't on balance sheet

Real example: Cisco in 2000s

Cisco had $10B+ in real estate operating leases (offices, R&D centers). Before 2019:

• Leases didn't appear on balance sheet

• Only monthly rent expense appeared on income statement

• Investors saw low debt-to-equity ratio (because $10B obligation hidden)

• Cisco looked more financially healthy than reality

2019 accounting change (ASC 842):

• All leases now on balance sheet

• Cisco's debt-to-equity ratio would adjust upward

• Better transparency for investors

Lesson: Read footnote disclosures on operating lease commitments (even though now on balance sheet, still worth monitoring).

Technique 3: Unconsolidated Subsidiaries

Definition: Company owns <50% of subsidiary (or has other technicalities) and doesn't consolidate it, hiding losses or debt.

Red flags:

• Subsidiaries owned 20-49% (equity method accounting, not consolidated)

• Equity method investments declining in value

• Related party transactions to unconsolidated subs

• Loss-making unconsolidated subsidiaries

How to detect unconsolidated sub risks:

1. Identify all unconsolidated subsidiaries (Note on Investments or Affiliates)

2. For each, ask: Is parent company exposed to losses?

3. Track equity method losses: If consistently negative, parent may have hidden losses

4. Calculate what balance sheet would look like if subs were consolidated

5. Assess: Would consolidation materially change financial profile?

Part 5: Reading the Footnotes (Where the Bodies Are Buried)

Fraudsters and aggressive accountants hide their worst lies in footnotes, assuming most investors won't read them. The forensic investor reads every footnote.

The Critical Footnotes (In Order of Importance)

Note 1: Summary of Significant Accounting Policies

Read closely for:

• Revenue recognition policy (most manipulated area)

• Changes from prior year (changes in policy = red flag)

• Unusual policies (e.g., "We capitalize marketing over 5 years" = aggressive)

• Management judgments (percentage-of-completion, warranty accruals, etc.)

Questions to ask:

• Is revenue recognition policy clear and conservative?

• Have policies changed this year? Why?

• Are policies consistent with peers?

Note 2: Revenue (NEW: Post-2018 accounting rules, explicit revenue note)

Read for:

• Breakdown of revenue by category (customers, geography, product)

• Contract terms (any unusual terms, rights of return, performance obligations?)

• Significant judgments in revenue recognition

Note 15 (or similar): Related Party Transactions

Read for:

• Who are related parties? (Executives, family members, controlled entities?)

• What transactions occurred?

• What were the prices vs arm's length?

• Any guarantees or contingent obligations?

Red flags:

• Related parties represent >5% of revenue

• Pricing not at arm's length

• No clear business purpose

• Management conflicts of interest

Note on Commitments & Contingencies

Read for:

• Lawsuits pending (could become liabilities)

• Debt covenants (could trigger default)

• Lease commitments (operating leases, pre-2019)

• Guarantees (parent guaranteeing subsidiary debt)

Note on Debt

Read for:

• Debt details (maturity schedule, interest rates, covenants)

• Refinancing risks (maturities clustered in next 1-2 years?)

• Covenant compliance (Is company near violating any covenants?)

• Default history

Note on Contingent Liabilities

Read for:

• Pending litigation (material exposure?)

• Tax uncertainties (IRS disputes?)

• Environmental liabilities

• Warranty reserves (are they adequate?)

Reading Management's Discussion & Analysis (MD&A)

The MD&A is where management explains the financial results. Read it forensically:

Red flags in MD&A:

• Overly optimistic tone despite declining results

• Vague explanations for deterioration ("market conditions")

• Focus on "adjusted" metrics (excluding bad items)

• No discussion of competitive threats or moat narrowing

• Minimal discussion of risks

Good MD&A signs:

• Honest assessment of challenges

• Clear explanation of unusual items

• Discussion of long-term strategy and moat

• Transparent about risks

• Reconciliation of non-GAAP metrics to GAAP

Part 6: Auditor Red Flags

The external auditor is investors' last line of defense. Auditor red flags suggest financial statement risk.

Red Flag 1: Going Concern Opinion

Definition: Auditor states "there is substantial doubt about the company's ability to continue as a going concern."

Implication: Company may not survive the next 12 months without restructuring, financing, or asset sales.

Action: Avoid stock (unless turnaround specialist/distressed investor). Equity likely wiped out in bankruptcy.

Red Flag 2: Auditor Resignation/Change

Definition: Company switches auditors mid-fiscal-year, or auditor resigns abruptly.

Red flags:

• Change during fiscal year (suggests disagreement)

• Company switching to smaller auditor (suggests prior auditor rejected accounting treatment)

• Auditor cited "management's accounting judgments" as reason for resignation

Real example: Wirecard's auditor (EY)

EY audited Wirecard until 2020:

• 2019: EY qualified opinion (auditors concerned, but didn't fully reject)

• Concerns about "missing bank confirmations" (SPVs in Philippines claiming $2B in cash)

• EY suggested independent investigation but didn't refuse to sign

• Wirecard rejected investigation, EY eventually resigned (2020)

• By then, fraud was public; stock collapsed 95%

Action: If auditor changes or resigns, dig deeper into reason. Request prior year audit documents.

Red Flag 3: Restatements

Definition: Company announces prior financial statements were misstated and must be restated.

Red flags:

• Restatement of prior year(s)

• Restatement due to fraud (vs. accounting error)

• Multiple restatements (suggests systematic issues)

Implication: Either management is dishonest or accounting is so complex that honest mistakes occur. Either way, earnings quality is questionable.

How to assess restatement severity:

1. Dollar magnitude: Does restatement change profit by >5%? (Major red flag)

2. Reason: Was it fraud (intentional) or error (unintentional)?

3. Frequency: Is this first restatement or third?

4. When discovered: Did management find it (good), or external party (bad)?

5. Management changes: Did CFO or auditor resign over it?

Red Flag 4: Audit Committee Independence

Definition: Audit committee should include independent directors, but if CEO's friends dominate, independence is questionable.

Red flags:

• CEO is chair of audit committee (unacceptable)

• Audit committee includes company executives

• Audit committee members appear to be CEO friends/allies

• Audit committee has no members with accounting/finance expertise

Action: Check proxy statement (DEF 14A) for audit committee members. If not independent, earnings quality is suspect.

Part 7: The Forensic Checklist (20 Points)

Build your own forensic screening checklist. For each stock, answer these 20 questions:

Revenue Quality (5 points)

1. Is revenue recognition policy clear and conservative? (Or vague, aggressive?)

2. What % of revenue is from related parties? (Ideal: <2%, red flag: >5%)

3. Is Days Sales in Receivables stable? (Or increasing faster than sales?)

4. Are there unusual customer concentrations? (Any single customer >10% of revenue?)

5. Has revenue recognition policy changed this year? (If yes: red flag)

Expense Quality (4 points)

1. Are depreciation policy changes disclosed? (If policy extending useful lives: red flag)

2. Is D&A declining as % of revenue? (Should be stable)

3. Are one-time/restructuring charges recurring? (If yes every year, they're not one-time)

4. Has capitalization policy changed? (Capitalizing more items is red flag)

Cash Flow Quality (3 points)

1. Is operating cash flow > net income? (Good sign: earnings are cash-backed)

2. Are major items categorized correctly (operating vs. investing)? (Or reclassified suspiciously?)

3. Is Days Payable Outstanding increasing? (If >20% increase: red flag)

Balance Sheet Health (4 points)

1. Are there unconsolidated subsidiaries? (If yes: understand why, assess risk)

2. Are there SPEs or special purpose entities? (Major red flag if yes)

3. Is total debt declining, stable, or increasing rapidly? (Rapid increase: red flag)

4. Are there unusual or intangible assets? (Goodwill increasing: red flag if organic business declining)

Management & Auditor Integrity (4 points)

1. Has auditor changed this year, or issued qualified opinion? (Red flag)

2. Are there restatements, or recent SEC investigations? (Automatic avoid if fraud-related restatement)

3. Does management have significant skin in the game? (Good: large shareholding. Bad: stock options only, no shares owned)

4. Is compensation heavily tied to accounting earnings? (If yes: incentive to manipulate)

Scoring:

• 18-20: Green light (excellent forensic quality)

• 15-17: Yellow light (acceptable, but monitor)

• 12-14: Orange light (caution, investigate further)

• <12: Red light (avoid, likely manipulation or major issues)

Part 8: Four Major Fraud Case Studies

Case 1: Enron (2001)

The Fraud:

• Created 3,000+ SPEs to hide $30B in debt

• Used mark-to-market accounting to recognize future profits as present earnings

• Round-tripped transactions among SPEs to create fake revenue

• CFO Andrew Fastow personally managed SPEs, enriching himself

The Forensics:

• Related party transactions: 40% of "revenue" (vs 2-3% normal)

• Receivables ballooning despite flat revenue

• Cash flow from operations declining while earnings increasing

• D&A suddenly changing (longer useful lives)

• Beneish M-Score: Would have flagged as 99%+ probability of fraud

The Outcome:

• Stock: $90 → bankruptcy

• Shareholders: $74B in losses

• Executives: 3 conviction (Lay, Skilling, Fastow), served prison time

• Accounting firm Arthur Andersen: Destroyed (convicted of obstruction, partners jailed)

Lesson: When related party transactions represent >5% of revenue, something is wrong. Enron's 40% should have been immediate disqualifier.

Case 2: WorldCom (2002)

The Fraud:

• Capitalized $11B in routine operating expenses (line costs) as assets

• Effect: Inflated earnings by $3-4B annually for 5 years

• Motivation: CEO's personal loans backed by stock; stock price collapse = personal bankruptcy

The Forensics:

• D&A declining as % of revenue (line costs capitalized, not expensed)

• Asset growth 5x faster than revenue growth

• Capital expenditures reported, but PP&E not growing accordingly (where did capex go?)

• Beneish M-Score: Would have flagged

The Outcome:

• Stock: $65 → bankruptcy

• Shareholders: $106B in losses

• CEO Ebbers: Convicted, served 16 years prison

• Auditor fraud: Audit team knew about problem but didn't report

Lesson: When capital expenditures reported in cash flow don't match PP&E growth, investigate. WorldCom's capex on balance sheet was inflated (actual capex lower, with gap explained by capitalized operating expenses).

Case 3: Valeant Pharmaceuticals (2015)

The Fraud:

• Channel stuffing: Forced distributors to buy excess inventory

• Related party transactions: Bought companies from CEO's friend's investment group

• Aggressive accounting: Capitalized R&D (non-standard)

• Reduced R&D spending while growing "top line" (revenue)

The Forensics:

• DSRI: 1.66 (days sales in receivables spiking) - major red flag

• Beneish M-Score: 0.82 (high probability of manipulation)

• Return rates: Would have jumped post-restatement

• Distributor complaints: Publicized in trade publications

The Outcome:

• Stock: $260 → $20

• Founder Pearson: Convicted of fraud and conspiracy

• Shareholders: $60B+ in losses

• Credit rating: Junk status

Lesson: Beneish M-Score would have saved investors. DSRI spiking from 62 → 103 days is screaming red flag.

Case 4: Wirecard (2020)

The Fraud:

• Fabricated $2B in cash held by SPVs in Philippines

• Auditors (EY) qualified opinion but didn't reject

• Management's claims unverified (independent audit was rejected)

• Sales fiction: Revenue inflated from fake B2B2C partnerships

The Forensics:

• Days sales in receivables spiking (customers didn't pay; sales were fabricated)

• Cash flow from operations declining (couldn't collect from fake customers)

• Goodwill ballooning (acquiring companies with no real value)

• Auditor's qualified opinion (first red flag)

• Auditor resignation (second red flag)

• Short sellers (Carson Block, Muddy Waters) uncovered fraud publicly in 2020

The Outcome:

• Stock: €191 → €0.01

• Shareholders: €25B in losses

• CEO & COO: Indicted, convicted

• Auditor EY: Fined €9M, reputation damaged

• Lesson: If auditor questions something in print (qualified opinion), take it seriously. Wirecard's 2019 qualified opinion should have been red flag.

Part 9: Assembling Your Forensic Arsenal

Step 1: Use ValueMarkers Beneish M-Score (Automated Screening)**

ValueMarkers Beneish M-Score Tool

Run M-Score on every stock you're considering. Automatic scoring:

• M > -1.78: Red flag (76% probability of fraud)

• M = -1.78 to -2.22: Yellow flag (moderate risk)

• M < -2.22: Green flag (low risk)

Step 2: Manual Forensic Review (20-Point Checklist)

For stocks passing M-Score screening, apply your 20-point checklist. Manually review:

• Revenue recognition policy

• Related party transactions

• Auditor reports

• Restatement history

Step 3: Financial Ratio Trends (10 Years)

Plot these ratios over time. Anomalies suggest manipulation:

• Days Sales in Receivables (DSR)

• Days Inventory Outstanding (DIO)

• Days Payable Outstanding (DPO)

• Gross Margin %

• D&A as % of Revenue

• Operating Cash Flow / Net Income

Step 4: Deep Reading (Footnotes & MD&A)

For final candidates:

• Read all 30+ footnotes

• Read MD&A carefully

• Search for red flag words: "subject to approval," "channel," "restructuring," "one-time," "adjusted"

• Download prior year 10-K and compare policies

Step 5: Management Verification

Call investor relations and ask specific questions:

• "Walk me through your revenue recognition policy"

• "What is your return rate by product?"

• "Have any accounting policies changed recently?"

• "What percentage of revenue is from related parties?"

• Management candor matters; evasiveness is red flag

Further Reading & Resources

SEC EDGAR Database (Primary Source)

Financial Shenanigans by Howard Schilit

Quality of Earnings by Thornton O'Glove

Beneish M-Score Academic Papers

ValueMarkers Beneish M-Score Tool