How to Conduct an Effective Fraud Investigation: The Complete Guide
Learn the steps to a successful fraud investigation, which can help protect your organization from reputation damage and financial losses.
Learn the steps to a successful fraud investigation, which can help protect your organization from reputation damage and financial losses.
In December 2022, a former director of finance at New York University was accused of diverting $3.4 million in funds meant to help minority- and women-owned businesses.
The fraudster allegedly created two shell companies, which she is accused of using to divert the money for personal use, including major renovations to her home.
No matter what industry you work in or the size of your company, you’re at risk of fraud schemes from employees, clients, vendors, and others.
Fraud investigations aim to uncover what behaviours occurred, by whom, and how. If you conduct a poor investigation, you’re not only at risk of failing to recover losses. You could also face reputation damage, legal fees, fines, or non-compliance penalties.
How do you handle a fraud case? Use the steps in this guide to ensure your work is thorough, timely, accurate, and compliant.
i-Sight software is a better way to manage investigations. i-Sight is a specialized investigative case management tool to make your investigations more efficient and consistent. Request your demo of i-Sight to find out how users are saving time, closing more cases, reducing risk, and improving compliance.
After you receive a fraud allegation or detect suspicious behavior, you have to decide if it’s worth investigating.
Before starting your investigation, consider the facts. Does it seem the report was made in good faith? Is there data to back up the allegation of fraud or theft?
The goal of a fraud investigation is to uncover whether it occurred and if so, who committed it. Determine:
Next, decide if you will use an internal or external investigator.
An internal investigator is inexpensive and gives you control over the timing and scope of the investigation. An external investigator, on the other hand, offers an impartial and objective perspective on the situation, but may cost more than your organization can afford.
If there is a whistleblower, interview the person who reported the fraud for context. If the fraud was discovered by an auditor, interview them.
Based on the information these witnesses share, determine whether you have a reasonable factual basis for an investigation. If you don’t, contact other sources (such as the accused person’s manager or cube mate) that could help provide more information. If there’s no one else to talk to or you still can’t reach the factual basis, an investigation may not be appropriate.
The key to reducing the damage caused by fraud is to stop it as soon as you detect it.
Change passwords and locks to prevent further theft of data or funds. If the alleged fraudster is a client or customer, suspend their system and/or building access during the investigation.
If you suspect an employee of fraud, consider temporarily suspending them with full pay until the investigation is complete. Clearly communicate to them that this is not a disciplinary measure and document the conversation. This step can protect you if the employee claims they were treated unfairly.
Reread your company’s policies surrounding ethics and compliance, fraud, and other relevant topics. This can help you determine what law or policy the fraudster violated.
Then, prepare for the investigation by reviewing the organization’s fraud investigation procedures. Download document templates (e.g. investigation report, investigation plan) to get organized faster.
Download our free fraud investigation checklist to ensure you don’t forget any key steps.
If you want your fraud investigation to be a success, you can’t go into it without a plan.
A plan gets your team all on the same page regarding the investigation’s goals, methods, and deadlines. Remember to be flexible, as your plan might change as the investigation progresses.
Identify exactly what you are trying to learn through the investigation. For example, what policy was allegedly violated and by whom?
Keep the investigation’s scope as narrow as possible to protect innocent people. Having a clearly-defined scope not only keeps your fraud investigation on track, but also ensures that it is fair and compliant.
Figure out which authorities or regulators you’ll need to report to (such as the Federal Trade Commission) if you determine fraud has occurred. This step helps you set a timeline and investigation strategy.
A clear strategy ensures you don’t miss any key information or duplicate efforts.
As you create your investigation plan, ask:
In other words, what do you need to do to investigate who did what actions, and in violation of what? When, where, and how did they do it? Who needs to do complete what steps and by when?
Next, make a list of individuals who could offer insight into the suspected fraud.
Start with the reporter (if there was one) and the employee’s manager. The suspect’s colleagues, friends, and family may also be able to provide motive, background, and other information that corroborates or contradicts the allegation.
Experts such as forensic accountants and data scientists can help you figure out how the fraud was committed.
Interview the suspect last. That way, you can ask them about all the details that came up in the other interviews.
Finally, set deadlines for each stage of the fraud investigation, including interviews, document retrieval, and reaching a conclusion. Assign tasks to members of your investigation team based on their strengths and knowledge.
Work fast to increase your chance of recovering losses and decrease the risk of losing evidence, but not so quick that you’re sloppy.
Find out how case management software can help you conduct better fraud investigations in our free eBook.
According to investigation expert Meric Bloch, “interviewing is usually the most important part of any investigation.” This is the stage when you gather the information you need to draw a conclusion from first-hand sources.
It’s a good idea to have a second investigator or an assistant in the interview to take notes, so that you can concentrate on the interviewee.
Many investigators record interviews, while some feel this can make the interviewee nervous. Before recording, check your state’s laws to see if you need the interviewee’s permission.
Begin each interview by explaining what will happen and what you expect of the interviewee. This allows you to stay in control while putting their mind at ease.
Explain that their answers will be kept confidential wherever possible. Assure them that they’ll be protected from retaliation, citing your organization’s anti-retaliation policy.
While you may be tempted to use an interview script, opt for an outline instead.
Bloch emphasizes that the interviewee’s answers, not your questions, are the evidence, so your wording isn’t as important as the information you receive. Plus, an outline allows the conversation to flow more naturally than a rigid script.
Interviewees are more likely to open up to a friendly person. Start by making small talk, rather than diving right into the tough questions.
Make them feel comfortable and thank them at both the beginning and end of the interview. No matter what information they provide, keep a positive attitude.
First, set a baseline with easy questions, such as “What is your position at [Company Name]?” or “How long have you known [Subject]?”
Ask open-ended questions to avoid leading the interviewee. For example, instead of “Did you see Kim shredding a vendor file?”, ask “What did you witness on July 15th?”.
Use clear, plain language, avoiding jargon or acronyms they might not know. Finally, make sure your questions are straightforward.
Download our cheat sheet to learn tips for building and maintaining rapport.
In addition to gathering details through interviews, you must review records, documents, photos, videos, and other evidence. Records provide information that interviewees may forget or intentionally withhold.
Looking through the accused person’s email history may reveal signs of fraud, such as large bank deposits or complaints about their finances.
Make sure your internal policies make it clear that you can access employee work emails at any time. If possible, get access to their personal emails, too.
If there is more than one suspect, read their correspondence with each other to find evidence of a fraud scheme.
Next, review the suspect’s personnel file. Look for red flags including:
All of these could be indicators of fraudulent behavior. However, be careful to only present the facts of this evidence, not inferences or judgements, in your investigation report.
Documents provide a snapshot of the time they were created, especially emails and instant messages from Slack or Microsoft Teams. For this reason, reviewing documents outside the scope of your investigation could muddle it.
Sticking to relevant records keeps your team on track and reduces your liability should the alleged fraudster challenge your conclusion.
As you investigate, keep copies of records on hand to review again. Retaining copies allows you to make notes on the documents without damaging the originals.
If you use a case management system, you can organize all of the investigation information, including interview notes, records, and other evidence, right in the case file.
Now that you’ve gathered evidence, assess if you have enough information to draw a conclusion. Have you found enough facts to guide your organization’s decision-makers in correcting and preventing this problem?
In fraud investigations, you can’t afford to determine the case inconclusive. Not convinced? The Association of Certified Fraud Examiners (ACFE) estimates that organizations lose five per cent of their revenues to fraud each year.
Analyze the evidence you’ve gathered. Bloch stresses that you should only use evidence for fraud investigations if it is:
If a piece of evidence doesn’t meet those standards, don’t use it when drawing a conclusion.
Confidentiality is key for any investigation, but especially important in fraud cases.
Lock up physical evidence. Protect digital information by encrypting files or using a secure case management platform with role-based access.
As an investigator, it’s your job to uncover facts based on evidence, not make judgements or assumptions.
When drawing a conclusion, use only objective facts, not inferences (what you assume based on a fact) or opinions (subjective beliefs you hold).
The goal of a fraud investigation is to prove or disprove each element of the allegation. Did the alleged behavior occur? Did the alleged fraudster do it? If you can’t achieve this with the evidence you’ve gathered, keep working until you can.
For instance, the allegation states that Bob stole money out of till number four on March 31. The work schedules you’ve reviewed prove Bob was working at till number four on March 31, and security footage shows Bob opening the till, removing funds, and slipping the cash into his pocket.
These pieces of evidence corroborate the allegation that money was stolen from till number four on March 31 and that it was Bob who took it.
Solid online research skills can make your investigations more thorough and efficient. Watch this free webinar to learn helpful techniques and tools for gathering information you need online.
“A well-written report, because of its reliance on facts and not speculation, shows both that you have done your job and that you met your responsibilities to the company,” explains Bloch.
Your fraud investigation report should be simple, factual, and limited by the scope of your investigation.
An investigation report should include your investigative approach, facts and analysis of the evidence, a determination, and recommendations for corrective action.
However, avoid drawing legal conclusions; leave that up to the appropriate authorities instead. Just focus on whether an internal policy was violated.
The final investigation report should present facts, not your opinions or judgements. To keep it objective, avoid using words like “allegedly” or “supposedly.”
Don’t use inflammatory or negative language. For example, say “During his interview, Bob looked around the room and avoided eye contact” rather than “Bob seemed nervous and shifty.”
In addition, never say that your determination is an outright fact. Instead, report that the investigation determined the elements of the allegation.
For instance, “The investigation determined that Bob created a fictitious vendor profile for XY Office Supplies. The investigation determined that Bob wrote a check for $2,000 to XY Office Supplies on August 4th. The investigation determined that Bob deposited a $2,000 check made out to XY Office Supplies into his bank account at World’s Best Bank on August 5th.”
In addition, include direct quotations where possible. You’ll be less likely to misconstrue an interviewee’s words and reduce your risk of a challenge to your determination.
Take thorough notes or record interviews (with consent) so you can include as many quotes as possible. If the accused person confesses or admits to fraud, report exactly what they said.
Limit your use of jargon, acronyms and technical terms. If you must use them, define each word or phrase the first time you use it in the report.
Your fraud investigation report should be able to stand on its own without supplementary documents or knowledge. If it doesn’t, simplify and edit until anyone could understand it.
You never know if your report might be read by someone who doesn’t know technical terms, such as a board member or external expert.
Finally, describe the records you used as evidence and the facts that you found in each one. Include copies of written and visual records, plus links or information on where to find other forms of evidence you cited (such as video or audio clips).
Reference organizational policies and procedures that were violated by the fraudster as well. Attach each of these documents with key passages highlighted, too.
If you’re still simply reacting to fraud and theft, you’re putting your organization, your employees, and your reputation at risk.
With i-Sight’s powerful case management software you can increase oversight, track and manage fraud investigations, and report on results for better risk management and prevention.
i-Sight’s award-winning reporting tool highlights trends and hot spots in investigation data, helping you identify your areas of risk. Use this insight to focus preventive measures and improve your program.
Learn more about how i-Sight can improve your organization’s investigations here.
To our customers: We’ll never sell, distribute or reveal your email address to anyone. Privacy Policy
Sign up for i-Sight’s newsletter and get new articles, templates, CE eligible webinars and more delivered to your inbox every week.