Auditor’s Guide to Information Systems Auditing

Chapter 36. Investigating Information Technology Fraud

In recent years, an enormous amount of publicity has been given to the threat of computer crime, which has led to a greater awareness at the executive level of the vulnerability faced within their information technology (IT) functions. The growth of organized fraud in the computer world in conjunction with the comparatively new threat of organized terrorism or politically motivated penetration of computer systems makes this awareness essential.

Advances in computer science have come at a staggering pace and computer crime has remained in step with them. Unfortunately, computer crimes happen in real time and the crime is completed in microseconds. Only a tiny percentage of such crimes were found in time to perform any form of meaningful investigation unless care had been taken beforehand to create an appropriate detective environment.

Where investigation is commenced, few will actually go to court and for all those prosecuted even fewer will be convicted. In many of these cases it is the fear of failure of prosecution and of exposing the corporation to ridicule that reduces the likelihood of prosecution. The failure of successful convictions is frequently due to a lack of proper care or methodical approach by the investigator. Frequently the evidence obtained is improper, inconclusive, and not legally gathered or maintained.

In addition, business moving onto the Internet has created the greatest opportunity for widespread and methodical ...