When Boston mobster James "Whitey" Bulger recently was captured in California after 16 years on the lam, investigators found him to be living comfortably, at least in the financial sense, with $800,000 in cash stashed in his rent-controlled Santa Monica apartment.Now that the initial police work has run its course, though, forensic accountants are taking over -- trying to figure out how Bulger and his girlfriend managed to make ends meet for all this time.It's an unusual job for forensic accountants: following the money to a decade-and-a-half of possible Bulger helpers. But the accounting specialty often attracts peculiar assignments -- detecting earnings manipulation and other business fraud by rooting through transaction trails and journal entries that may be designed to deceive. There they look for such items as recorded cash and accruals, searching for tell-tale anomalies.As tenuous as comparisons between business fraud and other types of crime may sound, there often is a surprising degree of similarity in how accountants try to untangle the complexities in the various areas where forensics are applied.'Just Paper Crap'Consider the work of James D. Ratley, president and CEO of the Association of Certified Fraud Examiners.Ratley graduated from the University of Texas at Dallas with a bachelors degree in business administration. In 1971, when he joined the Dallas Police Department, he was assigned to several divisions, including vice, child abuse and internal affairs.He recalls being the only one of about 2,300 fellow officers "who had any kind of degree in accounting," he says. So, "kicking and screaming," he found himself assigned to investigations that involved accounting. "Homicides are a lot more fun," he says. "Fraud was just paper crap."Since then, though, Ratley has made a career out of it, coming to recognize and delineate the red flags that help investigators detect business fraud. The most glaring? "Good news" in a bad economy, "when bad news is expected," he says. "When business is booming, the problem is that nobody questions good news."Burning Toast and a Smoke DetectorOther red flags are more specific.Toby Bishop, a forensic accountant who spent 20 years at Arthur Andersen before becoming director of Deloitte's Forensic Center, advises CFOs, auditors and regulators to "look for unusual relationships between related items." These tip-offs include any otherwise unexplainable anomalies between cash flows and reported earnings, the ratio of depreciation and amortization charges to balance sheet assets, and any sudden "ballooning" of the number of days sales that are in accounts-receivable status.While that last indicator can sometimes reflect the creation of "fictitious receivables" for use in manipulating earnings, he notes that there can be many explanations for this occurrence, such as when a "large customer has suddenly stopped paying," or the addition of a new client from a part of the world where it "may be common to take 180 days to pay bills."With currently available fraud detection tools often involving as many as 20 of these indicative ratios, false alarms typically occur some 90% of the time. So there's a "tradeoff between detecting a large proportion of fraud versus having a large proportion of false alarms," he says. "Just like a good smoke detector, it sometimes goes off when someone burns the toast. That can get distracting."'Cooking' with PastaBishop cites Messod Daniel Beneish, a professor at Indiana University's Kelley School of Business, as one of the researchers currently engaged in "tweaking" the tools used to analyze these indicators. Beneish's working relationship with Bishop was enhanced, the professor says, when his "model flagged Enron for [its audit firm] Arthur Andersen before the debacle" that resulted in Enron's collapse.Lately, though, Beneish has been involved with a new fraud indicator based on a case growing out of research into American Italian Pasta Co. (a turn of events that left one former student amused, he says, by the irony of a food-production company cooking the books.)American Italian Pasta was suffering years ago from Atkins Diet fallout -- and a resultant nationwide decline in carbohydrate consumption -- when the Securities and Exchange Commission found in 2004 that it had manipulated earnings by improperly capitalizing expenses. That led to a restatement of earnings, and a precipitous share price drop. As Beneish prepared a case study using American Italian, it became clear that the fraud could have been detected by looking at the ratio of the property, plant and equipment balance sheet line to company sales."If we had figured that out, we [also] could have caught Worldcom," he says of the finding, relating it to one of the major corporate frauds of the last dozen years.He has yet to publish his findings on the American Italian case. But generally, Beneish's research suggests that investors far too often are willing to bite at such fraudulent schemes.A 2005 paper he co-authored with Cornell University's D. Craig Nichols showed that while "firms with a high probability of overstated earnings have lower future earnings, less persistent income accruals and lower future returns," institutional investors -- those presumably in charge of the "smart money" -- actually "increase their holdings in firms with a high probability of manipulation." That tendency can stem from investor error, or a willing suspension of disbelief in the pursuit of gain. "If you get in early on a Ponzi scheme you could make out like a thief," he notes. On the other hand, many of the biggest money-making investments of recent times might have raised red flags -- but turned out to be legitimate blockbusters. For this reason, investors looking at a company that seems to have a "high probability of having cooked books," he says, may guess instead that the same indicators point to a company that is "going to be the next Microsoft." And they often are right.