ACC 5010 Module 4 Final Project: Forensic Strategy After a Cyberattack Example

After the Wire and the Lockout: A Forensic Accounting Strategy for Ramapo Valve and Fitting

Student Name

Master of Science in Accounting, Thomas Edison State University

ACC-5010: Principles of Forensic Accounting

Mentor Name

Month Day, Year

After the Wire and the Lockout: A Forensic Accounting Strategy for Ramapo Valve and Fitting

Introduction

Computer crime against companies increasingly produces accounting problems as well as technical ones. When a criminal impersonates a supplier and redirects a payment, or encrypts a company's systems and demands a ransom, the questions that follow are partly about servers and partly about money: how much was lost, who had access, what the records show, what insurance will cover and what must be disclosed. The FBI's complaint center has recorded billions of dollars a year in losses from business email compromise alone. A forensic accountant brings to these events the skills Crain et al. (2019) describe, investigative planning, evidence handling, analysis and quantification of loss, alongside the technical incident responders. This paper designs a forensic accounting strategy for one such victim.

The Case

Ramapo Valve and Fitting, Inc., a composite maker of industrial valves with about $180 million in annual revenue and 640 employees, suffered two attacks in the spring of 2026. In March, a message landed in the payables clerk's inbox that looked like it came from Ramapo's longtime casting supplier, saying the supplier had switched banks. The clerk updated the vendor master file and, the following week, sent a $1.42 million payment to the new account. The supplier's real collections staff called about the missing payment eleven days later. Three weeks after that, ransomware encrypted the company's enterprise resource planning system and file servers. Production stopped for six days, and full systems took nine days to restore from backups. The attackers demanded $2.5 million, which Ramapo did not pay.

Phase 1: Engagement, Scope and Privilege

The forensic accountant should be retained by Ramapo's outside counsel, so that work performed to help counsel advise the company can be protected by privilege and as attorney work product while the facts are unclear. The engagement letter should define the objectives: determine how the payment was diverted and whether anyone inside assisted, quantify all losses, support the insurance claim and recommend control improvements. It should also define coordination with the incident response firm already engaged through the company's cyber insurer, since the two teams will need each other's evidence. Separating the roles matters: the technical responders contain the attack and restore systems, while the forensic accountant follows the money and measures the loss.

Phase 2: Preserving Evidence

Evidence disappears quickly after an attack. Systems are rebuilt, logs roll over and well-meaning staff clean up. The first actions should be a litigation hold, preservation of email accounts involved in the fraudulent change, images of the clerk's workstation and the vendor master file history, and export of payment system logs and bank communications. The incident response firm should preserve forensic images of encrypted servers before rebuilding where feasible. Every item should be logged with its source, custodian, date and hash value so its integrity can be shown later. The federal guidance on incident response stresses preserving evidence while recovering operations and documenting each step (National Institute of Standards and Technology [NIST], 2025).

Phase 3: Investigating the Payment Diversion

The investigation should answer three questions. First, how did the false instruction arrive? Email header analysis, performed with the technical team, will show whether the message came from a look-alike domain, a compromised supplier mailbox or Ramapo's own compromised account. Second, why did controls fail? The vendor master change was made on the strength of an email alone, without a call to a known contact, and the payment went out without secondary review of a changed bank account. Third, did anyone inside help? The accountant should examine the clerk's access logs, when the change was made compared with when the payment run went out and any personal connections to the receiving account, while remembering that most such frauds succeed through deception rather than collusion. Findings should be stated without conclusions about anyone's intent.

Interviews follow the documents, not the other way around. The accountant, working with counsel, should speak first with people who can explain process without being implicated, such as the treasury analyst who released the payment run and the purchasing manager who knows how supplier bank changes normally arrive, and only then with the clerk who made the change. Each interview should be documented in a memorandum prepared promptly afterward. Because the clerk followed a request that looked routine, the interview should focus on what the email said, what checks the clerk understood to be required and whether anyone else saw the request, rather than on blame, which tends to produce defensive and less useful accounts.

The money trail matters for recovery. Ramapo's bank should have been asked immediately to recall the wire and to contact the receiving bank, and the FBI should have been notified, since rapid reporting sometimes allows funds to be frozen. In this case, $380,000 was frozen in the receiving account and later returned, leaving a net wire loss of $1,040,000.

Coordinating With the Bank, Law Enforcement and the Insurer

Three outside parties shape what the forensic accountant can do and when. The bank controls the recall and holds records of where the money went next, so counsel should request those records formally and the accountant should map each onward transfer, since funds in business email compromise schemes typically move through several accounts within days. Law enforcement may ask the company not to alert certain parties while it investigates, which affects the timing of interviews. The insurer will appoint its own adjusters and often its own forensic accountant, and many cyber policies require prompt notice and consent before the company incurs certain costs. The forensic accountant should keep a single log of every request and production to these parties, so the company's account of events stays consistent across the claim, any lawsuit and any criminal case.

Phase 4: Data Analytics

Analytics extend the investigation beyond the single payment. The accountant should extract two years of vendor master changes and payments and test for bank account changes made without supporting documentation, accounts shared by more than one vendor or by a vendor and an employee, payments to accounts changed within thirty days, and duplicate or sequential invoice numbers. A first-digit test of payment amounts against Benford's law can flag unusual patterns worth review, an approach Nigrini (1996) showed could identify anomalies in large populations of reported figures, though it signals where to look rather than proving fraud. If the attackers were in Ramapo's systems longer than discovered, analytics may also reveal earlier attempted changes that failed or went unnoticed.

Phase 5: Quantifying the Losses

Loss quantification serves the insurance claim, any recovery action and the financial statements. It should separate categories, because insurance coverage and accounting treatment differ by category.

The lost margin calculation follows the standard approach for business interruption: estimate the sales that would have occurred, apply the contribution margin rather than the gross margin because some costs stopped during the shutdown, and subtract sales recovered later. Each assumption should be documented with source data, such as the trailing 90-day sales average and the plant's overtime records, because the insurer's own accountant will test them.

Phase 6: The Insurance Claim

Ramapo carries a cyber policy with a $3 million limit, a $100,000 retention and a $250,000 sublimit for social engineering losses, the coverage that typically applies when an employee is tricked into sending money. The forensic accountant should map each loss category to the policy's insuring agreements. Under these terms, the wire loss is capped at the $250,000 sublimit, while business interruption and extra expenses fall under the main limit, subject to the retention and any waiting period. Ramapo's commercial crime policy should also be reviewed, since some crime policies cover funds transfer fraud. Presenting the claim with clear schedules and supporting documents, organized by policy section, shortens the adjustment process. Under these terms, the expected recovery is $250,000 for the wire, subject to the sublimit, plus $881,280 of lost margin and $610,000 of extra expenses under the main limit, less the $100,000 retention, or $1,641,280 in total, leaving Ramapo to absorb about $890,000 of its $2.53 million loss. That gap, most of it the uninsured portion of the wire, is itself a finding the board should hear, since a higher social engineering sublimit costs far less than the loss it would have covered.

Phase 7: Notification and Disclosure

Ramapo is privately held, so the federal securities rules that require public companies to disclose material cybersecurity incidents within four business days of determining materiality do not apply (Securities and Exchange Commission [SEC], 2023). It should still consider other obligations. If the ransomware attackers accessed employees' personal information, New Jersey's data breach law and other states' laws may require notifying affected individuals. Its lenders' credit agreements may require notice of material events, and its auditors will need to evaluate the losses, the insurance receivable and the control failures for the year-end statements. Research shows why these communications matter even for private firms: Kamiya et al. (2021) found that successful attacks on public companies caused significant shareholder losses and that firms responded by tightening risk management, while Gordon et al. (2011) found that the market's reaction to breaches varied with the kind of information exposed.

Phase 8: Strengthening Controls

The forensic findings should lead directly to control changes. Bank detail changes should require verification through a phone number already on file, never one supplied in the request, and a second person's approval. Payments to accounts changed within a set period should receive enhanced review. Multifactor authentication should protect email and remote access, and staff should receive training that uses the actual email Ramapo received. Backups should be tested and kept offline, since they are what allowed Ramapo to refuse the ransom. The accountant should also recommend that incident response plans include a forensic accounting role from the first hour, so evidence is preserved and losses are tracked as they occur.

Reporting the Findings

The forensic accountant's work should end in a written report addressed to counsel, structured so it can serve the board, the insurer and, if needed, a court. It should describe the engagement and its scope, list the evidence examined and how it was preserved, explain the methods used for the payment tracing, analytics and loss measurement, present findings in the order of the engagement's objectives and state limitations, such as records the attackers destroyed or systems the technical team could not image before rebuilding. Following the profession's forensic standard, the report should avoid conclusions about whether any employee acted dishonestly; it should state what the records show about who did what and when, leaving questions of intent to those with authority to decide them (Crain et al., 2019). Exhibits should include the timeline of both attacks, the vendor master change history, the flow of the diverted funds and the loss schedule with its supporting calculations.

Conclusion

A cyberattack produces a financial investigation as well as a technical recovery. For Ramapo Valve and Fitting, a forensic accounting strategy retained through counsel would preserve evidence before it disappears, trace the diverted payment and test for insider involvement, use analytics to find related weaknesses, quantify losses by category, present an organized insurance claim, address notification duties and turn the findings into stronger controls. The phases build in sequence, and the plan works best when the forensic accountant joins the response at its start rather than after the systems are restored.

References

Crain, M. A., Hopwood, W. S., Gendler, R. S., Young, G. R., & Pacini, C. (2019). Essentials of forensic accounting (2nd ed.). John Wiley & Sons.

Gordon, L. A., Loeb, M. P., & Zhou, L. (2011). The impact of information security breaches: Has there been a downward shift in costs? Journal of Computer Security, 19(1), 33-56. https://doi.org/10.3233/JCS-2009-0398

Kamiya, S., Kang, J.-K., Kim, J., Milidonis, A., & Stulz, R. M. (2021). Risk management, firm reputation, and the impact of successful cyberattacks on target firms. Journal of Financial Economics, 139(3), 719-749. https://doi.org/10.1016/j.jfineco.2019.05.019

National Institute of Standards and Technology. (2025). Incident response recommendations and considerations for cybersecurity risk management: A CSF 2.0 community profile (NIST Special Publication 800-61 Revision 3).

Nigrini, M. J. (1996). A taxpayer compliance application of Benford's law. Journal of the American Taxation Association, 18(1), 72-91.

Securities and Exchange Commission. (2023). Cybersecurity risk management, strategy, governance, and incident disclosure (Release No. 33-11216).