Houston, We Have a Problem: Managing a Security Investigation

April 1, 2003

Author's Note: Simple truths are often best revealed in the telling of a story. The tortoise and the hare come to mind. Following is a story with a few simple truths, not exactly Aesopian, but a story that invites you to get into the shoes of the main character.

You're the director of security for FNG, one of the nation's largest fabricators of oil field equipment. It's a few minutes before 8 a.m. at corporate in Houston when you receive a call from Dallas. The caller is Adam Rollo, a senior auditor whose office is just down the hall from yours. He's been in Dallas all week auditing a subsidiary that assembles high-pressure valves. "We have a problem," Rollo tells you.

Get the preliminary facts.

After filling three pages of yellow foolscap with scribbled notes, you agree with Rollo. It appears that the head of the Dallas office, a pushy guy named Chester Brown, is an embezzler. "And he must have had help," Rollo says. The concern in his voice drops a notch when you tell him you'll be in Dallas before sundown.

Form a team. Delegate and assign.

You brief your small staff: Madge Dowd, secretary; Jim Cowan, investigator; and Harvey Kantor, physical security specialist. Then you lay out their roles. "Madge, you hold down the fort here while Jim, Harvey, and I are in Dallas."

You tell Jim Cowan you want every one of the 56 employees in the Dallas office to be interviewed separately and privately, and as many times as necessary to piece everything together. "I'm putting you in charge of that, Jim. You'll have two, maybe three PIs to help." He nods his understanding. Only last month Cowan had worked with you in identifying outside vendors. He's an FBI retread, likeable, and possessed of common sense. He says, "We don't want to move too fast. If we hurry, we may miss something important." You are pleased to see him writing in the small notebook he always keeps in his shirt pocket. Notes taken early in the investigation will be invaluable later.

Harvey Kantor accepts with solemnity his role as custodian of things collected: witness statements, notes, sketches, diagrams, documents, printouts, ledgers, photographs, audio and video recordings, whatever. Harvey will also carry with him a notebook PC that he'll use to log in the collected materials, make a record of team activities, and keep track of expenditures.

Set objectives. Move deliberately.

The objectives in the preliminary stage are to gather up anything evidential, or potentially so, and identify the involved parties, including persons outside of the company. You envision a secondary stage in which the innocents will be differentiated from the possibly guilty. The investigation can then move to ... But wait. You are getting ahead of yourself. Take it one step at a time.

Get your boss in the loop.

You head to the executive floor and find your boss in the conference room with the CEO and CFO. Their expressions are grave as they listen to a voice on the speakerphone. It is the voice of Chester Brown in Dallas and he's vigorously protesting the "unprofessional tactics and unwarranted insinuations" of Adam Rollo. You catch your boss's eye and he joins you in the hallway. He okays your intentions, and you suggest he talk with the CEO about placing Brown on administrative leave, at least until the early facts are sorted out.

Obtain needed resources. Tap into existing technology.

The operator of a PI firm specializing in forensic accounting meets you as you deplane at Love Field in Dallas, late afternoon. You tell him you want three PIs skilled in interviewing and familiar with business practices. Included in the package of agreed services is the use of a software program that captures information from a variety of media, converts it to a common digital format, and places it in a data warehouse where it can be "mined," i.e., massaged in combination with other data. "Interesting match-ups are possible," you are told.

Rollo is staying at the Radisson, so you check in there. Cowan and Kantor do the same. The four of you dine early and spend the remainder of the evening discussing the case. Rollo explains that a company called Regal Petro ordered 14 specially configured valves to be delivered one by one, spread out over a period of a year. FNG purchased standard high-pressure valves from Andriscotti Valve Systems. The valves were delivered, one by one, to a workover site operated by Keith/Marwick, an engineering firm. The engineers configured the valves to Regal's specifications.

The whole ball of wax involving Regal, Andriscotti, and Keith-Marwick was handled by Brown personally, and on paper looked lucrative except for a couple of details: Brown overpaid Andriscotti by at least 100 percent, and the cost of configuring the valves was well above the industry norm. FNG paid about $4 million to Andriscotti and a little under $1 million to Keith/Marwick. Rollo scribbles a set of numbers on a paper napkin and says, "When we factor in our costs and profit, Regal has a tab with us for about $8 million."

You interject, "And Regal hasn't paid us a dime."

Rollo affirms. "Not one dime, which leads one to ponder." He conveys the ponderable. "Regal hasn't paid us because there is no Regal, and there is no Keith/Marwick."

Control the "scene." Collect evidence. Interview witnesses.

The following morning when you arrive at FNG's Dallas office you note that Brown is not there, per your request, and you are encouraged by this showing of management support. You meet privately with Brown's three direct reports: the managers of administration, procurement, and sales. When they leave the meeting they understand that every document in the office is under your purview, nothing is to leave the office without your approval, the shredding machine is to be unplugged and locked in a closet, and interviewing of employees is to commence within the hour. You add that a failure to cooperate will be grounds for immediate suspension.

Hold a daily meeting. Commend the work. Don't micromanage.

Your investigative team meets that evening at the Radisson. Each member of the team reports on the day's activities. Kantor has received, logged in, and marked as evidence several hundred pages of documents, plus six audiotapes; three PIs have interviewed 11 employees, all at the lower end of the food chain; and Cowan visited two courthouses where he examined the "doing business as" files and other records relating to Regal Petro and Keith/Marwick. Rollo is present and he briefs as well. You thank the team for making a good start on an important investigation. There is just the slightest temptation to tell Kantor of an evidence accounting method you once found effective. But you resist. "There's more than one way to skin a cat," you remind yourself.

Get expert help. Keep management informed. Deal with the news media.

It's apparent that the investigation will need to put to rest any concerns as to who signed what. You retain the services of a questioned document examiner and put her in touch with Kantor. E-mail to and from Brown may also be a source of evidence. You convince the head of FNG's IT department to provide the necessary expertise. Calling your boss on the phone twice a day is losing impact. You fly back to Houston and do a face-to-face with your boss and the CEO. You show them certain documents and advise that it may become necessary to suspend the procurement manager. Several indicators point in his direction but you want to keep him available for questioning, which you are not quite ready to do. While you're at home base, you visit the corporation's public affairs coordinator and warn him that the news media in Dallas will very likely pick up on the story. "I'll be counting on you to keep them off my back."

Focus on the evidence.

During the daily briefing at the end of the third day, you can see the outlines of a conspiracy. At a frequency of about once per month, Brown signed a purchase order for one valve. He approved payment one or two days after receiving notice from Andriscotti that the valve had reached the Keith/Marwick workover site. Cowan learns that the workover site is a warehouse six blocks from the Andriscotti plant.

Cowan goes there and finds a large crate bearing the Andriscotti logo. The operator of the warehouse says that about once a month a truck would deliver that same crate to the warehouse. He'd sign a receipt and about a week later, a truck would return and take the crate away. That had happened about a dozen times, the operator recalled. "Keith/Marwick, you say? Never heard of the outfit." The warehouse operator thought it strange that the crate was the same one every time. He didn't think it strange, however, that the person leasing the warehouse paid the rent one-year in advance, in cash. The physical description he gave of the lessee did not fit Brown.

Consult with in-house counsel. Protect your team.

FNG's head lawyer stresses three points: restitution, restitution, and restitution. You promise to keep him informed so that you can continue to benefit from his wise counsel.

Your boss calls and says he's received complaints from the Dallas office alleging heavy-handed tactics. Before you can leap to the defense of the team, your boss congratulates you on doing a good job. "Otherwise, I wouldn't be getting these pig squeals. Keep it up." Sometimes you just love the guy.

At the briefing that night Rollo says, "Now get this. Today I just happened to be on the phone with an accounts payable clerk at Andriscotti. I mentioned that FNG was thinking about going into a business relationship with a company called Keith/Marwick. I asked the clerk if she knew of them. She put me on hold and came back a few minutes later and said that in the past year her department had cut 13 checks, totaling a little over $40,000, payable to Keith/Marwick, for used valves." Rollo was excited. "You know what I think?"

You and Cowan both have an idea, but you let Rollo roll with it. "I think Andriscotti sold us 14 valves at twice their value and bought back 13 of them for pennies on the dollar."

You point to Cowan. "Go ahead, Jim." The former bureau agent reports on his visit to the warehouse. He winds up by agreeing with Rollo, except there was only one valve and it had been sold 14 times. It moved back and forth between the Andriscotti plant and the warehouse, probably to create supporting paperwork. "But that valve's traveling days are over. I've got a sheriff's deputy sitting on it right now."

Consult with the prosecutor. Get ready for trial.

Another week passes and you have most of what you need. More than 1,000 documents have been collected, including several incriminating e-mail messages between Brown and Victor Durgin, Andriscotti's VP of sales. You have an admission of malfeasance by FNG's procurement manager. The warehouse operator identified Durgin as the lessee of the warehouse. Checks paid to Keith/Marwick by FNG for engineering services and by Andriscotti for scrap metal were traced to an account in Bermuda. The "data mining" software used by the PI firm connected the holder of the Bermuda account to phone numbers in Brown's personnel file and his company e-mail address book. The bank account turned out to be held by Brown's half-sister. A payment of $400,000 was made from the account to Durgin; none to Brown. On the day you met with the prosecutor, Durgin's attorney offered restitution in exchange for FNG's promise to not push for imprisonment. Brown skipped town. You plan to ask the prosecutor about extradition from Bermuda.

John Fay welcomes your comments by phone at 404-817-7116 or by e-mail at [email protected].