In December 2022, a former director of finance at New York University was accused of diverting $3.4 million in funds meant to help minority- and women-owned businesses.

The fraudster allegedly created two shell companies, which she is accused of using to divert the money for personal use, including major renovations to her home.

No matter what industry you work in or the size of your company, you’re at risk of fraud schemes from employees, clients, vendors, and others.

Fraud investigations aim to uncover what behaviours occurred, by whom, and how. If you conduct a poor investigation, you’re not only at risk of failing to recover losses. You could also face reputation damage, legal fees, fines, or non-compliance penalties.

How do you handle a fraud case? Use the fraud investigation steps in this guide to ensure your work is thorough, timely, accurate, and compliant.

Decide to Investigate

After you receive a fraud allegation or detect suspicious behavior, you have to decide if it’s worth investigating.

Before starting your investigation, consider the facts. Does it seem the report was made in good faith? Is there data to back up the allegation of fraud or theft?

Assess the Situation

The goal of a business fraud investigation is to uncover whether it occurred and if so, who committed it. Determine:

• What law or policy was allegedly violated?
• Were multiple people accused?
• Do any of the suspects have a history of similar behavior?
• Do any of the suspects exhibit red flags of fraud (e.g. living above their means, working unusual hours, etc.)?

Choose the Investigator

Next, decide if you will use an internal or external investigator.

An internal investigator is inexpensive and gives you control over the timing and scope of the investigation. An external investigator, on the other hand, offers an impartial and objective perspective on the situation, but may cost more than your organization can afford.

Interview the Reporter

If there is a whistleblower, interview the person who reported the fraud for context. If the fraud was discovered by an auditor, interview them.

Based on the information these witnesses share, determine whether you have a reasonable factual basis for an investigation. If you don’t, contact other sources (such as the accused person’s manager or cube mate) that could help provide more information. If there’s no one else to talk to or you still can’t reach the factual basis, an investigation may not be appropriate.

Take Interim Action

The key to reducing the damage caused by fraud is to stop it as soon as you detect it.

Change passwords and locks to prevent further theft of data or funds. If the alleged fraudster is a client or customer, suspend their system and/or building access during the investigation.

If you suspect an employee of fraud, consider temporarily suspending them with full pay until the investigation is complete. Clearly communicate to them that this is not a disciplinary measure and document the conversation. This step can protect you if the employee claims they were treated unfairly.

Brush Up on Protocol

Reread your company’s policies surrounding ethics and compliance, fraud, and other relevant topics. This can help you determine what law or policy the fraudster violated.

Then, prepare for the investigation by reviewing the organization’s fraud investigation procedures. Download document templates (e.g. investigation report, investigation plan) to get organized faster.

Plan the Investigation

If you want your business fraud investigation to be a success, you can’t go into it without a plan.

A plan gets your team all on the same page regarding the investigation’s goals, methods, and deadlines. Remember to be flexible, as your plan might change as the investigation progresses.

Determine the Scope

Identify exactly what you are trying to learn through the investigation. For example, what policy was allegedly violated and by whom?

Keep the investigation’s scope as narrow as possible to protect innocent people. Having a clearly-defined scope not only keeps your fraud investigation on track, but also ensures that it is fair and compliant.

Figure out which authorities or regulators you’ll need to report to (such as the Federal Trade Commission) if you determine fraud has occurred. This step helps you set a timeline and investigation strategy.

Outline Your Strategy

A clear strategy ensures you don’t miss any key information or duplicate efforts.

As you create your investigation plan, ask:

• What do I already know?
• What do I need to find out?
• Who will I ask for information?
• What documents do I need to review?
• What methods will I use to prove or disprove the allegation?
• Who needs to complete each task?
• What is my timeline?
• Who needs to know the fraud investigation’s outcome?

In other words, what do you need to do to investigate who did what actions, and in violation of what? When, where, and how did they do it? Who needs to complete what steps and by when?

Make an Interview List

Next, make a list of individuals who could offer insight into the suspected fraud.

Start with the reporter (if there was one) and the employee’s manager. The suspect’s colleagues, friends, and family may also be able to provide motive, background, and other information that corroborates or contradicts the allegation.

Experts such as forensic accountants and data scientists can help you figure out how the fraud was committed.

Interview the suspect last. That way, you can ask them about all the details that came up in the other interviews.

Create a Timeline

Finally, set deadlines for each stage of the fraud investigation process, including interviews, document retrieval, and reaching a conclusion. Assign tasks to members of your investigation team based on their strengths and knowledge.

Work fast to increase your chance of recovering losses and decrease the risk of losing evidence, but not so quick that you’re sloppy.

Conduct Strong Interviews

According to investigation expert Meric Bloch, “interviewing is usually the most important part of any investigation.” This is the stage when you gather the information you need to draw a conclusion from first-hand sources.

It’s a good idea to have a second investigator or an assistant in the interview to take notes, so that you can concentrate on the interviewee.

Many investigators record interviews, while some feel this can make the interviewee nervous. Before recording, check your state’s laws to see if you need the interviewee’s permission.

Start With an Explanation

Begin each interview by explaining what will happen and what you expect of the interviewee. This allows you to stay in control while putting their mind at ease.

Explain that their answers will be kept confidential wherever possible. Assure them that they’ll be protected from retaliation, citing your organization’s anti-retaliation policy.

Use an Interview Outline

While you may be tempted to use an interview script, opt for an outline instead.

Bloch emphasizes that the interviewee’s answers, not your questions, are the evidence, so your wording isn’t as important as the information you receive. Plus, an outline allows the conversation to flow more naturally than a rigid script.

Build Rapport

Interviewees are more likely to open up to a friendly person. Start by making small talk, rather than diving right into the tough questions.

Make them feel comfortable and thank them at both the beginning and end of the interview. No matter what information they provide, keep a positive attitude.

Phrase Questions Carefully

First, set a baseline with easy questions, such as “What is your position at [Company Name]?” or “How long have you known [Subject]?”

Ask open-ended questions to avoid leading the interviewee. For example, instead of “Did you see Kim shredding a vendor file?”, ask “What did you witness on July 15th?”.

Use clear, plain language, avoiding jargon or acronyms they might not know. Finally, make sure your questions are straightforward.

Review Records

In addition to gathering details through interviews, you must review records, documents, photos, videos, and other evidence. Records provide information that interviewees may forget or intentionally withhold.

Review Email Records

Looking through the accused person’s email history may reveal signs of fraud, such as large bank deposits or complaints about their finances.

Make sure your internal policies make it clear that you can access employee work emails at any time. If possible, get access to their personal emails, too.

If there is more than one suspect, read their correspondence with each other to find evidence of a fraud scheme.

Look at the Personnel File

Next, review the suspect’s personnel file. Look for red flags including:

• Weeks of unused leave
• Logins to company accounts/networks at odd hours
• Advances on their pay
• Decline in performance

All of these could be indicators of fraudulent behavior. However, be careful to only present the facts of this evidence, not inferences or judgements, in your investigation report.

Only Review Relevant Documents

Documents provide a snapshot of the time they were created, especially emails and instant messages from Slack or Microsoft Teams. For this reason, reviewing documents outside the scope of your investigation could muddle it.

Sticking to relevant records keeps your team on track and reduces your liability should the alleged fraudster challenge your conclusion.

Retain Copies of Documents

As you investigate, keep copies of records on hand to review again. Retaining copies allows you to make notes on the documents without damaging the originals.

If you use a case management system, you can organize all of the investigation information, including interview notes, records, and other evidence, right in the case file.

Analyze Evidence

Now that you’ve gathered evidence, assess if you have enough information to draw a conclusion. Have you found enough facts to guide your organization’s decision-makers in correcting and preventing this problem?

In fraud investigations, you can’t afford to determine the case inconclusive. Not convinced? The Association of Certified Fraud Examiners (ACFE) estimates that organizations lose five per cent of their revenues to fraudeach year.

Determine Quality

Analyze the evidence you’ve gathered. Bloch stresses that you should only use evidence for fraud investigations if it is:

• concrete
• specific
• relevant to the investigation
• competent
• authentic

If a piece of evidence doesn’t meet those standards, don’t use it when drawing a conclusion.

Keep Evidence Secure

Confidentiality is key for any investigation, but especially important in fraud cases.

Lock up physical evidence. Protect digital information by encrypting files or using a secure case management platform with role-based access.

Separate Facts and Opinions

As an investigator, it’s your job to uncover facts based on evidence, not make judgements or assumptions.

When drawing a conclusion, use only objective facts, not inferences (what you assume based on a fact) or opinions (subjective beliefs you hold).

Check Evidence Against the Allegation

The goal of a fraud investigation is to prove or disprove each element of the allegation. Did the alleged behavior occur? Did the alleged fraudster do it? If you can’t achieve this with the evidence you’ve gathered, keep working until you can.

For instance, the allegation states that Bob stole money out of till number four on March 31. The work schedules you’ve reviewed prove Bob was working at till number four on March 31, and security footage shows Bob opening the till, removing funds, and slipping the cash into his pocket.

These pieces of evidence corroborate the allegation that money was stolen from till number four on March 31 and that it was Bob who took it.

Write the Final Fraud Investigation Report

“A well-written report, because of its reliance on facts and not speculation, shows both that you have done your job and that you met your responsibilities to the company,” explains Bloch.

Your fraud investigation report should be simple, factual, and limited by the scope of your investigation.

An investigation report should include your investigative approach, facts and analysis of the evidence, a determination, and recommendations for corrective action.

However, avoid drawing legal conclusions; leave that up to the appropriate authorities instead. Just focus on whether an internal policy was violated.

Avoid Inflammatory Language

The final investigation report should present facts, not your opinions or judgements. To keep it objective, avoid using words like “allegedly” or “supposedly.”

Don’t use inflammatory or negative language. For example, say “During his interview, Bob looked around the room and avoided eye contact” rather than “Bob seemed nervous and shifty.”

In addition, never say that your determination is an outright fact. Instead, report that the investigation determined the elements of the allegation.

For instance, “The investigation determined that Bob created a fictitious vendor profile for XY Office Supplies. The investigation determined that Bob wrote a check for $2,000 to XY Office Supplies on August 4th. The investigation determined that Bob deposited a $2,000 check made out to XY Office Supplies into his bank account at World’s Best Bank on August 5th.”

Use Direct Quotes

In addition, include direct quotations where possible. You’ll be less likely to misconstrue an interviewee’s words and reduce your risk of a challenge to your determination.

Take thorough notes or record interviews (with consent) so you can include as many quotes as possible. If the accused person confesses or admits to fraud, report exactly what they said.

Limit Jargon

Limit your use of jargon, acronyms and technical terms. If you must use them, define each word or phrase the first time you use it in the report.

Your fraud investigation report should be able to stand on its own without supplementary documents or knowledge. If it doesn’t, simplify and edit until anyone could understand it.

You never know if your report might be read by someone who doesn’t know technical terms, such as a board member or external expert.

Refer to Documents

Finally, describe the records you used as evidence and the facts that you found in each one. Include copies of written and visual records, plus links or information on where to find other forms of evidence you cited (such as video or audio clips).

Reference organizational policies and procedures that were violated by the fraudster as well. Attach each of these documents with key passages highlighted, too.