[Webcast Transcript] Trade Fraud Best Practices

HaystackID Blog | October 12, 2026

Editor’s Note: In a recent HaystackID® webcast, moderated by Ashish Prasad, Kevin Harnisch, Andrew Bayer, and Michael Sarlo examined why trade fraud has become a top enforcement priority, driven by rising tariffs, a new DOJ and DHS Trade Fraud Task Force, and an aggressive use of the False Claims Act. The panel broke down common schemes, including misclassification, double invoicing, transshipment, and shell companies serving as importers of record. It explained what separates a fixable customs error from real enforcement exposure. They also discussed how companies can test whether their compliance programs actually work, from reconciling customs values against payments to mapping the scattered data that investigations depend on. Along the way, the speakers addressed AI’s role in surfacing key evidence, the pressure to move quickly without sacrificing a documented audit trail, and the speed and transparency the DOJ expects in exchange for cooperation credit. Read the transcript below to learn why lawyers, forensic accountants, and eDiscovery specialists need to work together from the start, and how that coordination helps companies respond with confidence when the government comes calling.

---

Expert Panelists

+ Andrew Bayer, ACCA, CFE, CAMS
Senior Director – Global Investigations & Dispute Resolution, Hilco Global

+ Kevin Harnisch
Head of White Collar Defense and Investigations, United States, Norton Rose Fulbright US LLP

+ Ashish Prasad [Moderator] 
Vice President and General Counsel, HaystackID

+ Michael Sarlo  
Chief Innovation Officer and President, Global Investigations and Cyber Incident Response Services, HaystackID

---

[Webcast Transcript] Trade Fraud Best Practices

By HaystackID Staff

A product leaves a factory in China, passes through Vietnam, and arrives in the United States labeled as Vietnamese. On paper, everything looks clean. In reality, the company may have just avoided millions in tariffs, and the federal government is increasingly likely to notice. In HaystackID’s webcast “Trade Fraud Investigation Best Practices,” moderator Ashish Prasad brought together Kevin Harnisch of Norton Rose Fulbright, Andrew Bayer of Hilco Global, and Michael Sarlo of HaystackID to explain why trade fraud has become one of the government’s most active enforcement priorities. Harnisch described a crackdown that is already producing results: a joint DOJ and DHS Trade Fraud Task Force launched in August 2025, a new Resource Guide to Trade Enforcement, a nearly $550 million settlement with a group of California businesses, and more than $1 billion collected so far. Prosecutors are also using “reverse false claims” under the False Claims Act, mining their own data to find cases, and offering whistleblower awards even to people who participated in the misconduct.

So how does an ordinary business transaction turn into a federal case? Bayer reduced most schemes to a few simple questions: what the goods are, what they were worth, and where they were made. When the answers on customs paperwork don’t match the underlying records, problems begin. Examples include honey declared as syrup, a supplier sending one invoice to customs and a higher one to finance, and offshore shell companies with nothing behind them acting as importer of record. Harnisch admitted there is no bright line between a fixable customs error and an enforcement problem, calling the judgment “much more of an art than a science.” He said intent, the conduct’s scope, whether executives were involved, and the strength of the compliance program all shape where a case lands. The panel argued that a compliance program is only as good as its testing. Bayer urged companies to reconcile customs values against actual payments and to watch for sudden shifts in suppliers, shipping routes, or tariff codes. Sarlo explained that evidence is often scattered across ERP systems, foreign paper records, and encrypted messaging apps, and that modern AI can now process this mixed data far faster than a team of human reviewers.

When a red flag does surface, speed and discipline both matter. Harnisch warned against tunnel vision and confirmation bias, and noted that companies hoping for DOJ cooperation credit must move quickly and be prepared to disclose what they learn about individual wrongdoing. Bayer described following the money through every transaction and widening the inquiry when one bad shipment points to a larger pattern, while insisting that “the speed shouldn’t come at the expense of the well-documented investigation records.” Sarlo added that targeted preservation, chain of custody, and early use of AI keep investigations focused and defensible. The panel’s central message was that no single expert can handle a trade fraud matter alone. Lawyers, forensic accountants, and eDiscovery specialists have to work together from the start. Watch the recording and read the full transcript to learn how to spot these schemes early, test your defenses, and respond with confidence when the government comes calling.

---

Transcript

Mary Mack
Thank you for joining today’s HaystackID webcast, “Trade Fraud Investigation Best Practices,” hosted by the Electronic Discovery Reference Model. I’m Mary Mack, CEO and Chief Legal Technologist for the EDRM. Today’s expert panel is led and moderated by Ashish Prasad. He is the Vice President and General Counsel of HaystackID. The panel includes Michael Sarlo, Chief Innovation Officer and President of Global Investigations and Cyber Incident Response Services at HaystackID; Kevin Harnisch, Head of White Collar Defense and Investigations for the United States at Norton Rose Fulbright; and Andrew Bayer, he is the Senior Director of Global Investigations and Dispute Resolution at Hilco Global. We are recording today’s webcast for future on-demand access, and as with all HaystackID webcasts hosted by the EDRM, the recording will remain available on the EDRM global webinar channel throughout the next quarter to support your continued learning and reference needs. Before turning it over to Ashish for a fuller introduction and the agenda, Holley Robinson of EDRM will share a few brief notes on the webinar console. Over to you, Holley.

Holley Robinson
Thank you, Mary. If you look at the top of your screen, you’ll see the HaystackID logo, which you can click on to learn more about HaystackID. You’ll also see an option to contact Team HaystackID directly, along with speaker bios where you can learn more about today’s presenters. Moving down, you’ll see the Q&A box where you can type your questions for today’s panelists, and we highly encourage you to do so. We’ll be answering questions after the webcast. Below the Q&A, you’ll find today’s resources, including the slide deck, a link to learn more about HaystackID Global Advisory, and a link to register for HaystackID’s next webcast, “When Standard eDiscovery Isn’t Enough: Strategies for High-Stakes Specialized Litigation,” happening on November 18th at 12:00 PM Eastern. We’d love to have you join us again. Lastly, you’ll see some emojis down at the bottom of your screen. Please feel free to use them and react throughout the webcast. Back to you, Mary.

Mary Mack
Thanks, Holley. Our moderator and expert is Ashish Prasad, who is the Vice President and General Counsel at HaystackID. Widely regarded as a preeminent expert on discovery, litigation technology, and complex litigation over the past 25 years, Ashish has managed all aspects of discovery across hundreds of litigation and investigation matters. He’s developed policies and procedures for electronic discovery for corporations, law firms, and government agencies. He’s defended discovery compliance procedures before courts and regulators, and trained thousands of lawyers, litigation support professionals, technologists, law students, and others on best practices for electronic discovery and litigation technology. And without further ado, let me hand the baton over to you, Ashish, for a fuller introduction to the program.

Ashish Prasad
Thanks very much, Mary, and thanks very much, Holley. HaystackID really appreciates the EDRM sponsoring this webinar and inviting us to speak. We’re here this afternoon to talk about best practices for trade fraud investigations. Our focus is going to be on the practical side of trade fraud investigations. We are going to cover how to recognize potential trade fraud schemes, how to reassess a company’s compliance program, and how to respond when a concern becomes an actual investigation. Unlike most programs of this nature, we have sought to be interdisciplinary. So we’ve brought together the legal side, the forensic side, and the discovery technology side, which are the major sides for any investigation of this nature. We’re not going to try to cover every customs rule, but rather we’re going to try to help you understand what to ask, what types of evidence matter, and how to organize an effective response to a government investigation or an effective effort in an internal investigation. Let’s go over the agenda quickly so everyone knows what we’re going to be covering. We’ll begin with the Enforcement Landscape. We will then discuss key trade fraud schemes. We will then discuss reassessment of a corporate compliance program. We will then discuss conducting an efficient investigation. And finally, we will discuss key takeaways from this webinar. We’ve left five minutes at the end of the program for responding to audience questions. Please submit your questions as the program is going on, and we’ll do our best to answer as many of them as we can. So let’s turn now to the first topic of the webinar, which is the enforcement landscape. And I’d like to begin with Kevin. Kevin, why is trade fraud receiving so much attention now, and what should companies understand about the potential civil and criminal exposure that they face?

Kevin Harnisch
Thanks, Ashish, and thanks, everybody for joining. Certainly, trade fraud is receiving a tremendous amount of attention right now, and that’s probably largely driven by a few things. So, big-picture-wise, it’s consistent with geopolitical trends, it’s consistent with changes in the law, and it’s closely related to and is a natural extension of the focus on sanctions and export controls, which has certainly been growing in importance over the last few years. From a geopolitical standpoint, I mean, what I mean by that is prioritizing trade fraud investigations, it’s consistent with the administration’s stated priority of protecting American interests. In a nutshell, combating trade fraud is part of an effort of not let foreign companies avoid paying what is owed under the law and thereby gain a competitive advantage over American companies, pretty straightforward. From a legal development standpoint, I’m going to guess that virtually everybody on this webinar knows that tariffs have become a big hot-button issue over the last year or two. And with increased tariffs, there are increased incentives for companies to perhaps be a bit fast and loose or downright deceitful in an effort to try to avoid or to improperly minimize paying tariffs, duties, and money to the US. And then I’ll just also add something that sometimes gets overlooked in all of this is the concept of trade fraud really has grown to include forced labor issues, something that certainly has increased in both concern and therefore enforcement prominence in the US. So with those basic setting-the-stage concepts out of the way, let me touch a little bit on the enforcement landscape. And what becomes very clear if you track the enforcement developments, the government is doing much more than just paying lip service to the importance of trade fraud enforcement. You have now multiple agencies within the federal government that are looking at trade fraud-related issues. You’ve got the Department of Justice and its Fraud Division, you’ve got Customs and Border Protection, you’ve got Homeland Security investigations, to name the big ones. What that really does is kind of bring together a full panoply of civil and criminal theories of liability in the whole bit. And to try to, I guess, bring some structure into this and to demonstrate the importance of trade fraud investigations, the Department of Justice and the US Department of Homeland Security, a little over a year ago, back in August of ’25, launched a Trade Fraud Task Force, which basically pulls together prosecutions from multiple different agencies. You’ve got representatives from prosecutor offices and U.S. Attorney offices around the country. So really trying to coordinate their efforts. And then with that, those organizations have put together, recently, just in July, published the Resource Guide to Trade Enforcement. I would encourage everybody to read that. But a couple of interesting takeaways from that: it outlines some, let’s just say, creative areas for investigation and prosecution that just go beyond some of your traditional tariff-related investigations. It talks about how facts and circumstances could give rise to things like money laundering, wire fraud if you’re a public company, federal securities laws violations, RICO violations. And then significantly, what I want to highlight is the False Claims Act because that certainly is a hot area of investigation in the tariff and trade context that people need to be cognizant of. The False Claims Act imposes treble damages and penalties. So you’ve got big money at stake. Normally, people think of the False Claims Act as applying to schemes to obtain money from the US government improperly, but there is another aspect of that statute that applies to failing to pay money owed to the US government. It’s known as a reverse false claim. And that really ties into trade fraud theories where, say, a company may knowingly avoid paying duties by providing false or misleading information, for instance, to the US government, say, through customs and the like. So that opens up a rather new and creative way of investigating and prosecuting. The government is already collecting large amounts of money in connection with some False Claims Act schemes in the trade fraud context. And in May, you had a group of California businesses that agreed to pay nearly $550 million to resolve such claims. So they are putting their money where their mouth is. Just last month, the DOJ and the Joint Fraud Task Force announced that they had collected over $1 billion through their efforts in these types of cases. And then just a couple other quick things I will mention: they are really turning to data analytics, as they say, to try to affirmatively find cases on their own. They’ve set up a group to do exactly that. And the DOJ has expanded its whistleblower program to encompass trade fraud, have been publicizing wanting to do that and also saying that with respect to whistleblowers, they’ll be eligible for awards even if they themselves are involved in the misconduct. So there are a lot of efforts to be affirmatively trying to root around for cases to be investigated and bringing in this area. Ashish, I’ll kick it back to you.

Ashish Prasad
Great. Well, thanks very much, Kevin. Let’s turn now and talk about the key trade fraud schemes. Andrew, for someone who is not a customs specialist, what does trade fraud actually look like in an ordinary business transaction?

Andrew Bayer
Right. Thanks, Ashish, and thanks everyone for attending the session. So I think I would just echo Kevin here. I would start and refer to the DOJ and DHS guide that was published in July this year because it serves as a very useful resource as it identified 16 different trade fraud typologies. So it’s very helpful because it shows how DOJ is seeing these issues. But there’s also a very simple way of thinking about many of them. So when the goods enter the United States, you essentially ask five questions: What are the goods? What were they worth? Where were they made? How much was imported, and how were they produced? And so these questions take you directly to essential things that you put in the customs documents. So it’s classification, valuation, and country of origin. And the risk, the trade fraud risk, is basically revolving around these three parameters. So the first one is classification, where the key question is really whether the customs description or HTS classification matches what we’re buying. So I have to say that classification is not always black and white. So particularly for some complex products, there can be a legitimate judgment and interpretation involved. But the concern or risk is that essentially the same product is described or classified differently without any good underlying basis, because another tariff code produces a lower duty or a lower tariff. So, for example, if the company imports honey but then calls it a syrup, that’s an obvious inconsistency or red flag. Now, the second parameter is the valuation parameter. So if your customs value is quoted at $50, but then your finance or accounting teams pay $100, that’s a red flag. And I think the DOJ has already stated that they have seen an increased number of cases of double invoicing schemes. So this is the schemes where suppliers or buyers basically collude with manufacturers and manufacturers produce two different sets of documents. So one goes for the customs, the other set goes to the company’s finance or accounting team for payment. And now, thirdly, the origin- I think this is where transshipment schemes kick in. So if a product historically came from one country, and I think there are a lot of matters and cases around China nowadays, so if it comes from China and then suddenly starts coming through Vietnam or Mexico or any other country where there’s just a lower duty tariff, then you would want to understand what actually changed. So did manufacturing actually move, or did only the shipping route change? And the transshipment schemes have become a substantial and pervasive problem nowadays. DOJ is putting a lot of focus on it. I think there are a lot of estimates in the public domain, and they all range in the hundreds of billions of dollars of potential tariff evasion. Now, there are certainly other, more sophisticated, sometimes supplemental schemes. And I again, definitely recommend reading the DOJ guide. I would call out just a couple of schemes. So one is false duty refund claims. It’s when the company imports the product for future re-export, but the re-export either doesn’t happen or it’s a fake re-export, and a prevalent use of shell companies. It is fascinating that in the US, the importer of record can still be a company that is not registered in the US, but registered in foreign and sometimes offshore jurisdictions. And that scheme is pretty much exploited because you have an empty entity with no substance that imports the goods, and there’s no way to collect anything from that entity in case of government investigations. Irrespective and regardless of the particular scheme, I think the investigative approach is largely the same. So you compare what was represented to what the evidence actually shows. So on one scale, you have what was declared at customs and what the supplier told you. And on the other, you have the underlying records. So you’ve got purchasing data, payments, shipping, customs documentation. And the question really is, do they reconcile? And the gap, if there is a gap between this representation and underlying reality, is often where the red flags start to emerge. Now I’ll pivot over to Kevin. Kevin, when do you think a discrepancy, if we ever identify a discrepancy, becomes more an enforcement issue than a customs issue? Can you enlighten us?

Kevin Harnisch
Sure. And that’s obviously a critically important question. And I wish I could say there is a bright line, easy answer. As I like to tell folks, it’s much more of an art than a science. But when you boil it all down, there are going to be some things that any particular prosecutor is thinking of. So whether you’re responding to a government inquiry or you’re doing your own internal review and trying to assess what the risks are and whether or not perhaps you should get out in front of it and self-report, you’re going to be looking at the nature of the misconduct. Is there any indicia of intent, meaning people were taking active steps to falsify documents, try to hide things from supervisors, from third parties, from compliance, things like that. Whatever’s being addressed, is it pervasive, right? Is this a one-off instance, part of a much broader pattern? You want to look at whether senior executives were involved. That’s always a big issue for prosecutors. Were these rogue people down in the lower parts of the organization, or was there some sort of involvement or orchestrating efforts from on high, so to speak? And then certainly something that’s critical is taking a look at the compliance program and what efforts have been made to address some of these types of issues. Is this a result of people who are intentionally trying to circumvent a well-designed system, or was a system really not put in place effectively? So if you throw all of those different types of factors into the pot and look at them, you can start to get a pretty good sense as to whether you just may have something internal that can be fixed rather easily or whether you may actually have some exposure to government outreach.

Ashish Prasad
Mike, just to follow up on that, once a red flag is identified, what evidence helps you determine what actually happened and who knew what? I think you might be muted, Mike.

Michael Sarlo
Oh, sorry about that. Yeah, there’s a broad set of sources. And I think an important distinction as well to keep in mind is that these are going to tend to be multilingual data sets. And so that can make the investigation more difficult, and you may be pulling from data sources that exist all around the world. So obviously customs and broker records, and those would be looking for entry filings, declared values, tariffs, classifications, origin certificates, amendments. And what that can help to establish, obviously, is what was represented to the authorities and whether those representations changed. All of your commercial documents, your purchase orders, your contracts, your invoices, your packing lists, any side agreements. And from these, again, we’re going to be looking for a misstated price, a quantity, a product description, or undisclosed terms. You’re going to be dealing with billing and shipping and logistics systems, which can be very industry-specific. And so from these systems, we’ll get the actual routing, any intermediaries, signs of transshipment, and any type of discrepancies between the shipment and the declaration. We’re going to want to look at the manufacturing and the origin of record. And here we’re really trying to see if there are any types of bills of materials, like raw material and purchases, like logs, like factory, and like capacity. And here, from this category, what we’re really going to be trying to find out is whether those goods could actually have been manufactured at the claimed location; that’s a pretty huge red flag in some of these ERP and accounting systems, and in all of the banking information. And then finally, your stereotypical documents, emails, mobile-linked devices, secure messaging apps- all the places where individuals go to commit fraud- are very important. The initial data sources can be very data-driven as far as forms and transactions, but the story in these situations is obviously going to come from the communications and oftentimes can even circumvent overly broad data collection from many different parties. And I think that’s where these become very difficult for an organization to catch, so to speak, is that there are so many different entities that are involved in these types of shipping of goods. And so even just unlinking that map can be a challenge, so to speak.

Ashish Prasad
Let’s turn now to the reassessment of the compliance program. Let’s begin by asking the question: how should a company reassess its existing compliance program against trade fraud risks and DOJ guidance, and what should change in practice?

Kevin Harnisch
Well, I’m happy to jump in on that because that’s a critical question. If you want to start with a very basic concept, any company, when you’re operating in an environment where there are new or increased risks, and certainly as we talked about at the beginning, trade fraud would qualify, companies would be well-served in taking a step back and looking at their compliance program to assess whether maybe any tweaks, enhancements, or revisions should be made. So as a starting point, one of the things that we see being helpful to clients who are trying to evaluate this is to take the trade fraud guide that we’ve talked about, and then you look at the DOJ’s guidance regarding the hallmarks of an effective compliance program, right? Big, detailed document, and basically read them in conjunction with each other. That’s a very useful exercise. But if I don’t want to bore everybody with that, because we have limited time here, you want to think of some big-picture takeaways to be thinking about from that exercise. And one of the critical things is you want to make sure that your compliance program and how you are devoting resources to it in the trade fraud context is risk-based. That’s the buzzword. Through compliance programs, generally speaking, it’s making sure that you’re using the most effective way to allocate your compliance resources, both by volume and risk profile. So one of the basic starting points is you need to do a risk assessment, meaning people have to step back and think about, “Given the nature of our business, maybe it’s the nature of our supply chain, where we’re importing goods from, our highest dollar values,” where are your biggest risks, where you might be subjected to potential trade fraud-related issues? And then how is it that maybe you should reallocate some of your resources or reprogram some of the ways you’re analyzing data? And what you want at the end of the day is to be able to demonstrate to people- and people’s broad, it could be the government, it could be your board, there could be any number of constituencies- you want to be able to show that you’ve given thought, as an organization, to how you are surveilling, actively surveilling for these types of activities.One of the big questions that people need to be thinking about when you’re perhaps reassessing your compliance program is: what resources are you devoting to these areas? And by resourcing, I just don’t mean money, and I just don’t mean headcount. Those are both important. But you’ve got to be looking at the experience, knowledge, and qualifications of people who are running point and playing active roles in some of these compliance programs, because if something ever goes wrong, people are going to be wondering, however you’ve structured it, is this really more a cursory effort, window dressing, or is it reflecting a commitment to compliance? So you need to be able to demonstrate that commitment to compliance. And trade fraud, you want to be making sure that you’ve got active diligence, significant diligence programs with respect to your suppliers, your brokers, that you’ve got clear escalation channels, that you’ve got training, oversight, remediation, things like that. But, before I go on for too long, something where companies often fall short: what is the testing? You can have all the greatest designs in the world for a compliance program. How are you testing it to make sure that things are working appropriately in practice, right? What’s compliant? What’s internal audit doing? How are you using AI or other technology for pattern detection, document analysis, things like that? So you want to examine all of those issues, and if you go through that thoughtfully, carefully, you should be in a good position with your program.

Ashish Prasad
Thanks very much, Kevin. Let me ask a question now of Andrew. Andrew, how do you determine whether the program actually works when recognizing the actual risks in the business?

Andrew Bayer
Well, first of all, I have to give credit to many companies, and sometimes clients of mine, because the company might already have historically a very strong and robust compliance program, but it would just historically cover other compliance risks. So it might include money laundering or bribery and corruption because of the FCPA or data privacy or sanctions, et cetera, but still have gaps around trade fraud and forced labor. And so I would just practically focus on three things. So first of all, I would make sure that trade fraud and forced labor are explicitly included in the regular risk assessment, because in the past, I think it was not on the heat map because, again, it was perceived as a CBP/customs issue rather than an enterprise compliance risk, and this seems to be changing. In the risk assessment, again, I would try to understand the universe of the supply chain. I would look at what you buy, where it comes from, who handles customs, how suppliers are changing, and whether there were any changes as a result of the tariff pressures. Particular attention, I think, is to any changes, so any new suppliers, new manufacturing facilities, different shipping routes, pricing changes, or sometimes different tariff treatments. So this is usually where the risk starts to move. Then secondly, I would start benchmarking the compliance program. I think, as Kevin noted and I noted before, the DOJ guide has these 16 topics. So you just take them and basically see what’s applicable for your company and for your industry, and then go at the level- not at the policy level, but at the control level and see what controls are in place to mitigate that risk and what evidence tells you that those controls are actually working. For example, if you rely on supplier certifications, what supports them? How are they reviewed? If something goes wrong, what’s the escalation process? Do you have any right-to-audit clauses, and have you ever exercised them in case you needed to? Thirdly, and I think that’s the most important one from my perspective, is to test the actual transactions. I’m a big proponent of compliance monitoring because I do believe that this is where you see that the program is working in practice. The key here is really to understand the risks and the potential fraud scenarios, and then you can apply the current technology and AI that can cover a lot of ground and basically identify anomalies for you. So, tests like: if there were an introduction of new tariffs, was there any change in sourcing or shipping patterns? Or if your product was classified with one HTS code and then, out of the blue, it changes the HTS classification. Or, for example, you take two sets of data: one is customs, the other is finance, and then you try to reconcile them. So, the payments versus the customs values, do you see any discrepancies there? So based on that analysis, you typically come to a set of higher-risk areas, and then you basically pick higher-risk supplies or products or jurisdictions and test the transactions. So you connect the supporting documents that are available from various sources, as Mike explained. So you can take purchase orders, invoices, payments, shipping records, and where appropriate, you can also supplement it with external shipping data and corporate information and some other sources. And this exercise is typically very, very insightful because if the controls and documentation hold up, then that gives you comfort. And if they don’t, then it tells you where you need to look deeper.

Ashish Prasad
Thank you, Andrew. Mike, let’s turn back to you. What type of data has to be available and usable for the type of monitoring and testing that Andrew is talking about to work? And I would appreciate it if you could also talk, Mike, about the role of artificial intelligence in compliance monitoring. I’m guessing that there’s a lot of efficiencies we can gain from deploying the new AI technology that we all read about.

Michael Sarlo
Well, the first thing you need to do is actually map out these systems and who those data owners are. These could be different types of ERPs, many of the systems that we just identified. Retention settings are critical as it relates to being able to conduct an effective program. Elements and indicators of fraud may appear for old transactions. So having probably a little bit of a longer tail end on this type of data than you typically would is going to be fairly critical. For systems of ledger, you usually have that data. And then you do need to have really smooth data lanes from your third-party suppliers. And I think Kevin had mentioned having those clear escalation paths. You need to have clear paths around actually getting that data from these third parties regularly, very well-defined, so that those can be integrated into the broader data map and overall program. From a communication and messaging point of view, on platforms, any type of personal devices, third-party contractors, we really want to try to identify those to know where these could be black holes or if we want to change our policies and our procedures as far as how we approach these types of platforms. And then certainly in these investigations, you’re going to get highly disparate data. A lot of these goods are going through countries like Vietnam; they’re going through the Second World, and the systems really may be very paper-oriented, and they require a lot of human input to work. So having those clearly drawn out, and then again, those data flows with those partners to make sure you’re getting those receipts. Now I think here is where AI is really great now. AI does an excellent job as it relates to, like, vision AI. It’s very good at dealing with disparate data. We don’t need to rely on OCR as much to make a system understand what it’s looking at. It can be somewhat costly, actually, when we’re looking at images. But there’s going to be a lot of that in these types of compliance programs. And you really have to make sure that you’re leveraging these technologies, assuming that every data source is digital and ready [inaudible 00:37:19]; it’s again about testing your linking. And again, this is… to your suppliers, and the type of data that they generate in relation to these online transactions will allow you to handle, I think, a little bit more fluidly dealing with data that just isn’t easily linked from so many third parties. So think of it as a data lake approach, so to speak. And then you want to be able to tie all of these in around the… AI systems to be able to integrate more third-party data like transactions and ledgers and receipts and more geographically specific data sources, we can create really clear signals that should tell us where to look.

Ashish Prasad
Great. Thanks very much, Mike. Let’s turn now to conducting an effective investigation. And I’ll begin with the question for Kevin. Kevin, a credible concern has surfaced; what should happen first, and how do you avoid either an unfocused investigation or an overly narrow one?

Kevin Harnisch
Well, Ashish, that’s a critical question that I’d have to say comes up at the start of virtually every investigation when a client reaches out to us, not just in the trade fraud area. And it is very important, before you do anything, that you have a meeting of the minds with the client as to what the actual mandate is. What is your mission, so to speak? And that may sound simple, but that will often differ depending on the circumstances. For example, what you may do in a whistleblower allegation context may be a little different if you have something like an anomaly arising from a compliance review or if you’re addressing a request or a question that comes in from a counterparty, versus you have the government reaching out to introduce themselves and be asking for information. And then anytime you’re doing investigations like this, especially when you’re in a public company context, you need to keep in mind whether there are external timeframes that may impact what you need to do or how fast you do it. For instance, if you have upcoming public disclosures, if you’re appearing at upcoming investor conferences, or doing capital raises- things like that- that’s all going to impact what you do. So look, you’ve got to understand what the issue presented is- sounds basic- then you need to address it. But something I want to emphasize, because this is important and it rears its head time and time again: the people doing the investigation and the people within the client, you need to keep an open mind as evidence develops. You need to avoid tunnel vision, and you can’t suffer from confirmation bias. I can’t say it enough. Objectivity is absolutely critical. And believe me, there’s no need to start with the premise of needing to boil the proverbial ocean. Nobody wants that anymore. That may have been an issue a decade or more ago, but not anymore. Instead, you need a reasonable investigation work plan that’s credibly designed to get to the bottom of the issue. And going with objectivity, that means asking the difficult questions of people in the know. You can’t shy away from that. And at the end of the day, if you find an issue, you need to know that you’ll ultimately need to be able to answer the question to the government, to the board, to the C-suite; you’ll need to be able to answer the question as to your level of comfort that the issue that was found does not exist elsewhere. Again, doesn’t mean you boil the ocean, but think about how to best ring-fence things so that you can credibly be answering that question. So I think those are some of the initial things to be keeping in mind as you’re scoping an investigation.

Ashish Prasad
Thank you, Kevin. Back to you, Mike. What should be preserved and collected first, and how do you avoid turning preservation into an indiscriminate collection of everything?

Michael Sarlo
Sure. So I would say we start out really wanting to identify the key actors that we know of at the outset and make sure there’s a legal hold in place. And typically speaking, we’re going to be going after the communications- those types of messaging apps, like Signal, like Telegram- getting a really good understanding of mobile phones and emails. Obviously, not all companies or individuals are aware that they’re in the middle of these types. All the typical business records are important. We want to go out and get the emails. We want to have a good sense of third-party resources that are at risk of deletion. It doesn’t mean we definitely need to collect them and review them, but they should be preserved. And so really the way to make sure this doesn’t turn into a boondoggle is an effective and programmatic preservation plan. And many of these systems do allow us to export a master record. Sometimes they don’t. Sometimes it can be even more complicated when you realize there are issues and there’s a lot of inbound shipping going on and you can’t stop those shipments. So it becomes more of a perpetual legal hold. Those can be more technically challenging than, like, dealing with your typical email systems. And then getting the right time periods and just making sure you have a good preservation map, and starting with where we believe we’re going to gain the most fruit. And so we can use AI to sift through data very quickly at a lower cost than a human to help us surface key actors, key events, and data sources that we may be missing. This is kind of the new technology that we use in almost every investigation on the ECA side. So that’s a great way to, even if you are having to collect, shift those costs to AI [inaudible 00:45:10] in your case. And oftentimes you find that smoking gun and ask an insurance question too. Are we going to take the questions at the end, or does anybody want to field that?

Ashish Prasad
We’ll take them at the end.

Michael Sarlo
Okay, great. And certainly we just want to make sure we have a defensible process. All the things like chain of custody, making sure that we have our metadata, that it’s been collected, and that we’re vetting it against our actual documents. It’s not uncommon to have scans and paper documents that may have technical upload dates and certain types of metadata that are out of sync with what’s actually on that document. So again, that’s something you really want to be thinking about: your paper trail strategy. And certainly leveraging AI at every phase to reduce the cost of reviewing this.

Ashish Prasad
Thank you, Mike. Back to you, Andrew. Once the evidence is secured, how do you actually determine what happened?

Andrew Bayer
Well, first of all, I think of the initial allegation, whether it comes from a whistleblower or an audit finding or something that was identified in the analytics as the tip of the iceberg, because it gives you a really good starting point, but then once you begin unpacking it, you may find other facts or reflections underneath. And so the first step is really to test the allegation. If the allegation is right, then what would we expect to see in the records? And more importantly, or just as importantly, what evidence would point you in the other direction? Because you still want to keep the investigation neutral. The objective is not really to prove the allegation, but to get to the truth and understand what has actually happened. And then you follow the transaction. This is where a lot of my work comes in. So I would typically reconstruct the underlying activity first. So I would get all the data sources or data points: the purchase orders, invoices, shipments, customs entries, receipts, and payments. And then you identify people involved at every stage. And that gives you basically the factual framework that you can work off. And then the electronic document review you conduct, the interviews you conduct, will provide much more context. So from there, you need to triangulate the evidence. So you’re basically comparing the supporting documents or data you have with one another. For example, you compare payments to the invoice; you compare shipping history to the claim origin; you can compare electronic communications to any changes that were made in the records, or the interview representations or accounts to the documents. And at the same time, I also advise you to look outside of the four walls of the company. There’s currently a great number of data sources or databases that can enrich your analysis. So you can get external trade and shipping data; you can get corporate and ownership records. You can also look at litigation and enforcement information, which all in all and overall will help you test what the supplier is telling you or what your company is telling you. And the external information, for example, can give you a lot of insight. So it can give you information on similar shipments from similar suppliers or the same suppliers. It can get you some background information on ownership of the supplier or importer of record, or actually it can also trace the product to the original manufacturers through one or two or even three countries. One important point here is I don’t think that the scope is really static. Well, unless it’s a 200, 300 page AI scope, as we now see a lot of uptick of AI assisted allegations, especially in the False Claims Act space. But in other cases, when there’s a more tangible or credible allegation, I think you have to reassess the scope at every stage. So eventually, an initially isolated issue may become a signal of a broader problem. So you may start, for example, with one transaction; it could be just a shipment of some electronic component from China using your preferred supplier, but then you go deeper, you basically understand, well, there were similar concerns in the past that were never addressed, or there were some representations made by the supplier or broker that were never tested or supported. You might go to the contract and see there were audit clauses, but they were never exercised for some reason. And then you test the anomaly that’s in the allegation against the public records or against the internal records, and you do see the discrepancy. And at this point, I think the defensible investigation needs to do the look-across. So basically, if you have that one isolated issue, you would still want to understand what other products were supplied by the same supplier, or what other suppliers supplied to you, what generally the imports from those specific countries came to your company, and then you basically reapply the same process again.

Ashish Prasad
Thank you, Andrew. Let’s go back to you, Mike. How can we turn the collected information into reliable findings efficiently, and what should council receive at the end of that effort? I think you’re muted, Mike.

Michael Sarlo
Yeah. Thank you. Certainly, technology is going to streamline all of this using defensible tools to ensure that we’re getting good text extraction. We understand our document types, that we’re keeping the linkages between attachments and emails, and things that generate attachments for different systems of record. Having a good sense of where the exceptions are, anything that is corrupted, if there’s any type of encryption or password protection, and making sure that we have a clear track around remediating those and going back, if we need to, to where they came from. From a search standpoint, once we normalize all of our data, we want to be using AI in any investigation. Search terms are helpful. They tend to miss, and the technology has gotten to a point where we can typically describe that we use our own stack, like discovery with AI; that case background, instead of allegations, comes back with a full timeline and will tell you where you may want to investigate further. It’s very good at identifying key concepts from disparate data sources. And then around the review, we want to have an expert review team that’s aware of the regulations. They understand what they’re doing, and they have domain expertise in this kind of evolving space of trade fraud. So really, make sure that you’re vetting that team. And finally, we’re going to give you back a report, and hopefully we don’t have to produce anything. But if we are, we’ll have a clear audit trail going back to all of those data sources we talked about preserving with a full chain of custody because it’s so important in these types of investigations.

Ashish Prasad
Thank you, Mike. Let’s go back to Andrew. Andrew, once the key evidence is identified, how do you turn that evidence into defensible trade fraud findings, and how do you quantify the impact? Andrew, I think you’re muted.

Andrew Bayer
Sorry. Yes. So yes, it’s a good question. Again, as an investigator, I think I’m still a big proponent of a well-documented investigative audit trail. And now there has been a lot of pressure, I would say, with the advent of AI, to basically minimize the time for the investigation because, again, there are a lot of AI-assisted allegations. There are a lot of AI data miners, which basically accelerates the time. And so I think there’s a lot of pressure on the investigation teams to reduce the investigation timing. But again, the speed shouldn’t come at the expense of the well-documented investigation records. So in the forensic accounting world, I think as long as you have the audit trail and the documents are tied to the original sources, then that becomes very defensible. Now, we do work with the council a lot, just on the legal strategy, how to disclose certain findings, and whether some of the things will be privileged and confidential and will not be disclosed. But at the end of the day, if you can show the true evidence of the transaction and then the intent or lack of intent of the people, then you would be in a good shape to respond to the government.

Ashish Prasad
Great. Thank you very much, Andrew. Let’s go back to Kevin. Kevin, let’s say you now have all the findings of the forensic examination supported by the electronic discovery activities. How do those findings affect decisions about responding to the government, cooperating, or voluntarily disclosing violations?

Kevin Harnisch
Sure. And important considerations. I know we’re running short on time, so I’m just going to be brief and touch on one aspect that you mentioned, Ashish, and that’s from a cooperation standpoint. The Department of Justice has a whole framework around cooperation and pathways towards getting credit for cooperating, reduced charges, or outright declinations. There are a couple of things that flow from that. Speed is incredibly important. So you’ve got to make your decision fast because if you’re going to self-report and get that full cooperation credit, you’ve got to go to them before they find the information on their own. As I mentioned earlier, they’re taking a lot of proactive steps, including paying whistleblowers for information. So speed is critical. That oftentimes means you may have to make the decision before, frankly, the whole investigation is done. And then cooperation has a lot that goes with it. So if you want to be cooperating from a DOJ standpoint, that means being transparent about everything that you found about what individuals did and how far up the proverbial food chain that goes. And that oftentimes can cause a lot of angst with corporate clients. So just know speed is key, and going into corporate means going full open kimono, so to speak, and sharing what you’ve learned about individual culpability, because especially in this administration and Department of Justice now, there’s an emphasis on really bringing actions, including criminal actions against individual wrongdoers and crediting companies for providing pathways to do so.

Ashish Prasad
Thank you, Kevin. Let’s turn now to some key takeaways. And what I’d like to do is orient each of you three toward a question that’s been on my mind during this entire webinar. You will recall that I said at the outset of the webinar that we would take an interdisciplinary approach, which includes not just the law firm, but the forensic accounting firm and the eDiscovery service provider. I’ll begin with you, Kevin, but then I’d also like to hear what Andrew and Mike have to say on that. My impression from this webinar is that it is of critical importance that there be coordination between the law firm, the forensic accounting firm, and the eDiscovery service provider, because without that type of coordination, I don’t know how the right questions are asked, the right questions are answered, and the right information is provided in the right way to the government. What guidance can you give, each of you, to in-house counsel who are confronted with trade fraud investigations on how they can help facilitate that kind of coordination between those three legs of the stool? I think a lot of our in-house listeners might be thinking that, well, once they hire the law firm, it’s the law firm’s job to kind of do everything, but that does not seem to be the case from this webinar.

Kevin Harnisch
So I’m happy to go first. You’re absolutely right. I’m not just saying that because I consider you a friend. But that is absolutely spot on. The way I like to think about it, and we tell clients this all the time, while I’d love to think that lawyers can do everything and that we’re all smart people, at the end of the day, what’s best for the client and everybody involved is that you’re putting together a team of experts where everybody’s being put to their highest and best use. And as you’ve heard over the course of the last hour or so, and Ashish, you were underscoring this as well, there are a lot of different components. The law is one part, but you can’t apply the law unless you know all of the facts. So you’ve got to go get the relevant information. You need to be testing huge amounts of data oftentimes. So I mean, just think of it big-picture-wise, doing those three things together, you need the lawyers, you need the forensic piece, you need the eDiscovery piece because you really can’t effectively deliver a wholesome result to a client if you’re skimping on either of those areas.

Ashish Prasad
Andrew and Mike, I’d love your thoughts, if any, on the question I asked Kevin.

Andrew Bayer
Thanks, Ashish. I totally agree with you and Kevin. I think as part of the investigation process, any company should have an investigation playbook that would address this risk specifically and would have an action plan in case something is getting escalated. I would just also tell the audience, but I would treat the DOJ guide as an action plan because we refer to it as a more reading material, but it is an action plan. And even the DOJ, I think, insists that companies now go back and start assessing the supply chain. So I just wouldn’t wait for a wave of enforcement cases before determining whether their controls actually work. I would just start the work right now.

Ashish Prasad
Thank you. Mike, we’re going to give you the last word before we go back to Mary for audience questions.

Michael Sarlo
Yeah, I’ll add to that. Again, having a solid understanding of the data sources that are out there, the third parties, and having a playbook and having your data collection strategy built into that playbook, and making sure that you’re evolving that playbook because your business changes regularly and you have a framework for integrating new suppliers. And that you have your bench, know who your key resources are, your key outside counsel, your key vendors, and bring those folks together regularly, whether it’s quarterly or not, to actually test your program.

Ashish Prasad
Great. Well, thanks very much, Mike, and thanks very much, Andrew and Kevin. Let’s send it back to Mary to handle any audience questions that might have emerged during the program or that emerge now.

Mary Mack
Thank you, Ashish. We have a question from Judge Warshofsky: “Are there any insurance issues that come into play when the government comes calling?”

Kevin Harnisch
I’m happy to chime in on that one. The short answer is yes, and then the lawyerly answer. It will depend, and what it depends on really is the nature of the insurance policy. So they can cover the gamut, where sometimes policies will explicitly exclude investigative inquiries and wait until allegations have actually been made. And then, of course, you get the various exclusions that go with that, some of which cost a little more money, maybe a little more encompassing, to help with government investigative responses.

Mary Mack
Excellent. And the next question is, “What would be your preferred workflow for combining the eDiscovery process with the attorney’s document knowledge for a speedy review?”

Michael Sarlo
My preferred workflow is to layer AI on at the earliest stage using ECA-based narrative techniques to source those hottest documents earlier. This allows us to have much smaller review teams. And oftentimes it’s an SME-led review. We’ve reduced the corpus of data so much that it opens up budget for folks from Norton Rose to be involved heavily in the review. So we’re really able to create space for higher-value work using this earlier on. And so I would want to avoid using a large review team in any investigation. If I had to, I would then be taking away and those to, like, a continuous act of learning review model.

Mary Mack
We’re losing the last part of your sentence there. Well, I believe we’ve got some interference. So what I will do is thank all of you for joining today’s HaystackID webcast. Thank you to our panelists for sharing their expertise. And before closing, please mark your calendar for HaystackID’s next webcast, “When Standard eDiscovery Isn’t Enough: Strategies for High-Stakes Specialized Litigation,” happening on November 18th at 12:00 PM Eastern. You can find the registration link in today’s resources, and we hope to see you there. On behalf of EDRM, we sincerely appreciate your participation today. Wishing everybody a productive day. Thank you.

Ashish Prasad
Thank you.

---

Expert Panelists

+ Andrew Bayer, ACCA, CFE, CAMS
Senior Director – Global Investigations & Dispute Resolution, Hilco Global

Andrew Bayer is a Senior Director in Hilco Global’s Investigations & Dispute Resolution practice, where he advises law firms, corporations, boards, and investors on complex investigations, regulatory matters, disputes, and compliance issues. He has more than 15 years of experience leading cross-border matters involving fraud, bribery and corruption, financial misconduct, sanctions and trade-related issues, whistleblower allegations, and other integrity risks. Andrew regularly brings together forensic accounting, eDiscovery, data analytics, and investigative techniques to develop facts from complex and disparate data sets and support counsel in high-stakes matters. His experience spans the Americas, Europe, Asia, the Middle East, and the post-Soviet region. Prior to joining Hilco Global, Andrew held senior forensic and investigations roles at Charles River Associates and EY. He is an ACCA member, Certified Fraud Examiner (CFE), and Certified Anti-Money Laundering Specialist (CAMS).

+ Kevin Harnisch
Head of White Collar Defense and Investigations, United States, Norton Rose Fulbright US LLP

Kevin J. Harnisch is Head of White Collar Defense and Investigations, United States, at Norton Rose Fulbright. He represents corporations, boards, executives, broker-dealers, investment advisers, private equity funds and financial institutions in SEC, DOJ, CFTC, FINRA and other regulatory investigations, enforcement actions and complex internal investigations. A former Branch Chief in the SEC’s Division of Enforcement, Kevin led investigations involving financial fraud, market manipulation, insider trading, Foreign Corrupt Practices Act (FCPA) violations and municipal securities matters. He now advises clients across a wide range of industries on securities enforcement, corporate investigations, regulatory compliance and governance issues. Kevin has extensive experience defending public companies and financial institutions in matters involving financial reporting, internal controls, whistleblower allegations, anti-corruption compliance, insider trading, anti-money laundering, supervisory controls and conflicts of interest.

+ Ashish Prasad [Moderator] 
Vice President and General Counsel, HaystackID

As Vice President and General Counsel of HaystackID, Ashish Prasad works with corporate legal departments and law firms to achieve compliance with discovery requirements in litigation and government investigations. He has more than 25 years of experience in discovery, litigation technology, complex litigation, and government investigations. His work includes developing discovery policies and procedures, managing discovery matters, and defending discovery practices before courts and regulators. Chambers USA has recognized him in Band 1 for eDiscovery Litigation Support. Previously, Ashish served as a litigation partner and as Founder and Chair of the Electronic Discovery and Records Management Practice at Mayer Brown LLP; Founder and Chief Executive Officer of Discovery Services LLC; and Vice President and General Counsel of eTERA Consulting.

+ Michael Sarlo  
Chief Innovation Officer and President, Global Investigations and Cyber Incident Response Services, HaystackID

Michael Sarlo works closely with HaystackID’s software development and data science teams to deliver best-in-class data collection, eDiscovery, and review solutions that allow legal teams to act on data types typically not conducive to collection, review, or production in the context of eDiscovery. Sarlo works closely with clients on the most challenging and complex regulatory, investigative, and civil litigation matters. Sarlo also oversees HaystackID’s Cyber Discovery and Incident Response Services division. He leads a cross-functional team of HaystackID experts that regularly assists insurers, breach coaches, and their corporate clients when a data breach occurs.

---

About HaystackID®

HaystackID® solves complex data challenges related to legal, compliance, regulatory, and cyber requirements. Core offerings include Global Advisory, Cybersecurity, Core Intelligence AI™, and ReviewRight® Global Managed Review, supported by its unified CoreFlex™ service interface and eDiscovery AI® technology. Recognized globally by industry leaders, including Chambers, Gartner, IDC, and Legaltech News, HaystackID helps corporations and legal practices manage data gravity, where information demands action, and workflow gravity, where critical requirements demand coordinated expertise, delivering innovative solutions with a continual focus on security, privacy, and integrity. Learn more at HaystackID.com.

Assisted by GAI and LLM technologies.

SOURCE: HaystackID