ACCT 660 Week 7 Individual Research Project Part 2 Example

Detecting and Investigating the FTX Fraud: An Examiner's Plan and a Biblical Worldview

Introduction

Part 1 of this project described how FTX customers' money was used by Alameda Research, how features in the exchange's code exempted Alameda from the rules that protected other customers, how the resulting shortfall was hidden and how a news report and a run on the exchange exposed it in November 2022. This paper asks two questions. First, what could a fraud examiner, internal or external, have done to detect the fraud before it collapsed the company? Second, once the fraud was suspected, how should it have been investigated? A final section considers how a biblical worldview shapes the examiner's approach to a case of this kind.

The fraud triangle offers a starting point. Pressure came from Alameda's trading losses and its need for cash for investments; opportunity came from common control of the exchange and the trading firm and from software that could be changed by a handful of people; and rationalization appears in the belief, described at trial, that the money would be paid back. Dorminey et al. (2012) note that later fraud theory adds capability and the characteristics of predators who seek positions from which to commit fraud. Here, the founder and a few engineers had both the authority and the technical skill to change the rules of the system itself. That combination points to where an examiner should have looked.

Points Where Detection Was Possible

Three features of the case created detection opportunities. The first was a mismatch between liabilities and assets: customers' balances were recorded in the exchange's systems, but the assets behind them had been moved to Alameda. Any process that compared the two would have revealed a gap. The second was the code itself. The exemptions Alameda received were settings in the exchange's risk system, and settings can be queried. The third was the related-party relationship, which produced flows of cash and assets between the two companies that a forensic accountant could test. Executives' statements to lenders and investors offered a fourth, weaker opportunity, since false statements can be checked against records.

Detection Procedures

Reconcile customer liabilities to assets held

The most powerful procedure would have been a full reconciliation of what FTX owed customers with the assets it actually controlled, asset by asset. For each currency and token, the examiner would total customer balances from the exchange's ledger and compare the total with holdings in the exchange's own wallets and bank accounts, confirmed independently with banks and through the blockchain. A shortfall of the size alleged, about $8 billion according to prosecutors (U.S. Attorney's Office for the Southern District of New York [USAO], 2024), could not have survived such a test.

Research on cryptocurrency exchanges explains why the reconciliation must cover both sides. Dagher et al. (2015) show that an exchange proving it holds certain assets proves little unless it also proves what it owes, since assets can be borrowed for the day of the proof. Their proposed protocol demonstrates solvency by proving that assets exceed liabilities while protecting customer privacy. An exchange that publishes its assets without its liabilities has shown only half of a balance sheet. An examiner applying that principle would have insisted on customer-level liability data, not only wallet balances.

Query account settings in the trading system

The second procedure would have targeted the software directly. An IT examiner could have extracted the configuration of every account in the exchange's risk engine and listed accounts with any exemption from standard rules: exemption from automatic liquidation, permission to carry negative balances, or a credit line above the normal maximum. Because the SEC alleged that Alameda alone received such treatment (U.S. Securities and Exchange Commission [SEC], 2022), a simple query sorting accounts by these settings would have isolated it. The examiner would then ask who authorized each exemption and whether it was disclosed.

This is an IT general controls question as much as a fraud question. Research on companies that reported IT control weaknesses shows that such weaknesses tend to accompany failures in other controls (Klamm & Watson, 2009). The bankruptcy administrators found exactly that pattern: a small group controlled the code, changes were not subject to independent review, and records of decisions were kept in messaging applications set to delete automatically (Ray, 2023). An examiner reviewing change management would have found that no one outside the founding group approved changes to the risk engine, which is itself a red flag. Insider threat research adds that privileged technical users who can alter systems present the greatest risk when their changes go unmonitored (Cappelli et al., 2012).

Test related-party flows with forensic analytics

Third, the examiner would treat every transaction between FTX and Alameda as a related-party transaction requiring explanation. Nigrini (2011) describes tests that suit this work: profiling transactions by size and counterparty, testing for round amounts and duplicates, and examining the largest items individually. Applied to transfers between the two companies, these tests would highlight large, round transfers and repeated movements of customer deposits to Alameda-controlled accounts. Customer fiat deposits sent to Alameda's bank accounts but recorded as FTX liabilities, as described in Part 1, would appear as cash received by one company and owed by another, a pattern any reconciliation of the two companies' books should catch.

Continuous monitoring would have made these tests routine. Vasarhelyi et al. (2004) describe layers of analytic monitoring that compare transactions and balances with expected models and raise alerts on departures. A monitoring layer that compared Alameda's account balance on the exchange with its permitted credit limit each day would have alerted on the first day the balance went negative beyond normal limits.

Compare what outsiders were told with the records

Finally, the examiner would compare statements made to investors and lenders with internal records. Investors were told that customer assets were protected and that Alameda had no special privileges (SEC, 2022), and lenders received Alameda balance sheets that understated its borrowing. Matching each statement to the records behind it is ordinary audit work, but it requires access to both, which is why independent governance matters. FTX had no independent board, internal audit function or audit committee able to demand that access.

The Role of Auditors and Regulators

It is fair to ask why the parties whose job is detection did not find the fraud. FTX's financial statements were audited, but the audits were not designed around the risk that mattered most, the relationship between the exchange and a trading firm owned by the same person. An auditor who identified that relationship as a significant risk would have tested balances between the two companies, asked for the configuration of Alameda's account and requested evidence that customer assets were held in full. Each of those requests falls within ordinary audit work on related parties and on IT general controls. Regulators faced a different obstacle: the international exchange operated from the Bahamas, outside direct U.S. supervision, and crypto exchanges were not then subject to the custody rules that govern brokers. The lesson for accountants is that the detection procedures proposed here were available to anyone with authority to demand the data. What was missing was an independent party with that authority who chose to use it.

Investigation Plan

If any of these procedures had produced predication, the investigation would have proceeded in a deliberate order.

Preserving evidence would come first. Because the companies used messaging applications that deleted messages automatically (Ray, 2023), the first step would be a litigation hold, the suspension of automatic deletion and forensic copies of devices, servers, code repositories and the exchange's databases. The code repository's history is particularly important, since it would show when the exemptions were added and by whom.

Analysis of records would follow: rebuilding the companies' books from bank statements, exchange data and blockchain records, since the existing accounting records were unreliable. Tracing would then follow customer money from deposit to final use, through Alameda to venture investments, real estate, loans to executives and political donations, as the SEC alleged (SEC, 2022). Blockchain transactions can be traced with established methods, and bank records can be obtained through legal process. In practice, tracing in a case of this size requires a team that combines forensic accountants, who understand ledgers and bank records, with blockchain analysts, who can follow assets across wallets and exchanges. The two kinds of evidence must be joined at the points where crypto assets were converted to dollars or dollars to crypto assets, since those conversions usually pass through institutions that keep identity records.

Interviews would come next, in order from the outside in. Engineers and finance staff with knowledge of the code and the records would be interviewed before senior executives, and the founder last. In the actual case, the most valuable witnesses were insiders who cooperated after pleading guilty, including the engineer who wrote the code. Their testimony was corroborated by the code itself and by records, which is the standard an examiner should apply to any cooperating witness.

Last, the examiner would quantify the shortfall by customer and asset, report findings to counsel and regulators, and avoid any conclusion on guilt, which belongs to the courts. Here that determination came through a federal trial, a unanimous verdict on every count and a 25-year sentence (USAO, 2024).

How a Biblical Worldview Shapes the Approach

A biblical worldview shapes this case in at least four ways. The first concerns stewardship. Jesus taught that someone who has not been faithful with what belongs to another cannot be trusted with what is his own (English Standard Version Bible, 2001/2016, Luke 16:12). An exchange holds other people's property by definition. The FTX fraud was, at its root, a failure of stewardship, treating customers' money as available for the owner's purposes. The examiner's first procedure, reconciling what is owed with what is held, is simply the practical form of asking whether a steward has been faithful.

The second concerns truthfulness. Proverbs calls deceitful speech detestable to God and says He takes pleasure in people who deal honestly (English Standard Version Bible, 2001/2016, Proverbs 12:22). The scheme depended on false statements to customers, investors and lenders, and on software that displayed balances the company could not pay. A biblical worldview treats those misrepresentations as a moral wrong, not just a legal violation, and it requires the examiner's own report to be scrupulously accurate, neither overstating findings to satisfy public anger nor softening them for powerful parties.

The third concerns the motive behind fraud. Paul warns that the craving for wealth leads people into traps and that loving money gives rise to every sort of evil (English Standard Version Bible, 2001/2016, 1 Timothy 6:9-10). The case is a reminder that intelligence and good intentions offer no protection against that temptation, which is why controls should never depend on trusting any person's character, including a founder who presents himself as acting for the public good.

The fourth concerns justice and mercy. Micah sums up what God requires as acting justly, loving mercy and walking in humility before Him (English Standard Version Bible, 2001/2016, Micah 6:8). For an examiner, justice means pursuing the truth for the sake of the customers who lost their savings, many of them ordinary people. Kindness and humility mean treating every person interviewed with dignity, including those who did wrong, recognizing that cooperating witnesses who admit their part are taking a step toward repentance, and remembering that the examiner is also capable of the same failings. A biblical worldview therefore sets a high standard of rigor and a low tolerance for cruelty in the same investigation.

Limitations

Several of the procedures described here would have required access that outsiders did not have. An external auditor or a regulator could have demanded the data; an ordinary investor could not. The plan also benefits from hindsight, since the code exemptions and the related-party flows are known now because the bankruptcy administrators and prosecutors uncovered them. Finally, this paper relies on public filings and press releases rather than the underlying records, so its description of what the tests would have found is an inference from those sources.

Conclusion

The FTX fraud was detectable. A reconciliation of customer liabilities to assets would have revealed the shortfall, a query of account settings would have exposed the code exemptions, and forensic analytics applied to the flows between the exchange and Alameda would have shown where the money went. None of these procedures was exotic; each depended on someone independent having the authority to perform it. Once suspected, the fraud called for preserving evidence, rebuilding records, tracing funds and interviewing from the outside in. A biblical worldview supplies the reasons behind this work, faithful stewardship of others' property and truthfulness in every statement, and the spirit in which it should be done, with justice for victims and humility toward everyone involved.

References

Cappelli, D. M., Moore, A. P., & Trzeciak, R. F. (2012). The CERT guide to insider threats: How to prevent, detect, and respond to information technology crimes (theft, sabotage, fraud). Addison-Wesley.

Dagher, G. G., Bunz, B., Bonneau, J., Clark, J., & Boneh, D. (2015). Provisions: Privacy-preserving proofs of solvency for Bitcoin exchanges. In Proceedings of the 22nd ACM SIGSAC Conference on Computer and Communications Security (pp. 720-731). ACM. https://doi.org/10.1145/2810103.2813674

Dorminey, J., Fleming, A. S., Kranacher, M.-J., & Riley, R. A., Jr. (2012). The evolution of fraud theory. Issues in Accounting Education, 27(2), 555-579. https://doi.org/10.2308/iace-50131

English Standard Version Bible. (2016). Crossway. (Original work published 2001)

Klamm, B. K., & Watson, M. W. (2009). SOX 404 reported internal control weaknesses: A test of COSO framework components and information technology. Journal of Information Systems, 23(2), 1-23. https://doi.org/10.2308/jis.2009.23.2.1

Nigrini, M. J. (2011). Forensic analytics: Methods and techniques for forensic accounting investigations. Wiley.

Ray, J. J., III. (2023). First interim report of John J. Ray III, Chief Executive Officer and Chief Restructuring Officer, to the independent directors on control failures at the FTX exchanges (In re FTX Trading Ltd., Case No. 22-11068). United States Bankruptcy Court for the District of Delaware.

U.S. Attorney's Office for the Southern District of New York. (2024). Samuel Bankman-Fried sentenced to 25 years for his orchestration of multiple fraudulent schemes [Press release]. U.S. Department of Justice.

U.S. Securities and Exchange Commission. (2022). SEC charges Samuel Bankman-Fried with defrauding investors in crypto asset trading platform FTX [Press release].

Vasarhelyi, M. A., Alles, M. G., & Kogan, A. (2004). Principles of analytic monitoring for continuous assurance. Journal of Emerging Technologies in Accounting, 1(1), 1-21. https://doi.org/10.2308/jeta.2004.1.1.1