An anticipated spike in bankruptcies could pose asset retrieval problems for some lenders
With COVID-19-related government subsidies for consumers and businesses slated to wind up this year, insolvency practitioners are expecting to see a surge in bankruptcies within the next year.
“The phenomenon that's happened with the pandemic is that there's been a hiatus on insolvency filings due to the government stimulus,” says Bryan Tannenbaum, who runs the restructuring and recovery practice for RSM Canada, which provides audit, tax and consulting services focused on middle-market businesses.
The phenomenon is international in scope, he says; “with the government’s support, it's more like kicking the can down the road. … When the music stops, there’ll be an abundance of insolvencies. That’s what is anticipated.”
Those insolvencies will be on both the consumer and corporate side, he says; but the use of digital forensics can help Canadian banks and other lenders build cases when attempting to recover assets owned to them by business owners and creditors who may try to hide or destroy this information.
When a business defaults on its loan and a lender appoints a receiver to take possession of the company’s assets, time is of the essence, he says. The receiver must seize control of the business’s operations before important documents are hidden or destroyed, thereby preserving evidence. Receivers may also have to seek court orders, such as access orders or document preservation orders, to compel a debtor and its management to cooperate with the receiver by providing the documents sought.
Unethical business activity that digital forensics teams must navigate to acquire the necessary information can include the deletion of incriminating emails and financial spreadsheets, and the destruction of phones, computer systems and cloud servers.
Tannenbaum cites instances in which computers of insolvent businesses have been wiped of all data, and servers go missing; “I've walked into a computer room, there's been a server rack there, … and all the servers are gone.” There are also situations passwords and credentials are needed to gain computers, and if companies gave purposely wiped their computers, that is one element that can be used to demonstrate intention to commit fraud, “to withhold information, that payments were made in preferential treatment, that principals of the company withdrew money prior to the eve of the receivership, etcetera.”
“All of that evidence is very, very necessary for our court proceedings, and reporting back to the court and to the creditors.”
These are all reasons to get in and collect, preserve and analyse digital forensic evidence as early and quickly as possible using specialized cyber investigators and technology, says Ryan Duquette, a digital forensic specialist who leads the security and privacy risk consulting practice of RSM Canada -- especially as the mishandling of data could result in the evidence being deemed inadmissible in court.
The collection and preservation of evidence “is vitally important,” Duquette adds.
“We've seen cases in the past where either the parties involved maliciously deleted [client] content or evidence, prior to us getting involved, or IT departments would come in and start the collection and preservation of evidence, but wouldn't follow the proper methodologies.” If the case ever goes to litigation, poor methodologies may be challenged, and evidence may have been contaminated or destroyed.
“A lot of investigators will just open a laptop and start looking through it for evidence; in my opinion, that’s like walking through a crime scene,” says Duquette, who spent 15 years as a police officer.
And if any of the cases he works on become subjects of criminal prosecution, “it is a much smoother process if we have collected evidence in the same way law enforcement would, and we can just hand evidence over to them for their investigation,” he adds. In matters where an initial civil investigation has been done, and individuals have tramped over the evidence and destroyed, it becomes “very challenging … to recover that evidence” afterwards.
As for analysis, Duquette says, a variety of digital forensic tools will be used in working with an investigator to look at the evidence. The digital environment has made that a more complex process, and the complexity will be increased by the amount of a client needs. Evidence may be stored in different databases, and proprietary software may be used. But using their digital forensic tools, “we can run keyword systems across an entire system to look for everything all at once,” he says, making the process quicker and more exhaustive; “that’s been of value for investigators.”
