How to Conduct a Fraud Investigation: The Complete Guide

Decide to Investigate

 

After you receive a fraud allegation or detect suspicious behavior, you have to decide if it’s worth investigating. You should launch an investigation when you have a reasonable factual basis (RFB) to believe fraud occurred. This means you can reasonably believe that a law, regulation or company policy has been violated.

 

Assess the Situation

 

First, determine whether a fraud occurred and if so, who committed it. What law or policy was violated? Was more than one person involved? Do any of the suspects have a history of similar behavior?

 

Choose the Investigator

 

Next, decide if you will use an internal or external investigator. An internal investigator is inexpensive and gives you control over the investigation. An external investigator, on the other hand, offers an impartial and objective perspective on the situation, but may cost more than your organization can afford.

 

Interview the Reporter

 

If there is a whistleblower, interview the person who reported the fraud for context. If the fraud was discovered by an auditor, interview them. Based on the information they share, determine whether you have a reasonable factual basis for an investigation. If you don’t, contact other sources that could help provide more information. If there’s no one else to talk to or you still can’t reach an RFB, an investigation may not be appropriate.

 

Take Interim Action

 

The key to reducing the damage caused by fraud is to stop it as soon as you detect it. Change passwords and locks to prevent further theft of data or funds. If the alleged fraudster is a client or customer, suspend their account during the investigation.

If you suspect an employee of fraud, it might be advisable temporarily suspend them with full pay until the investigation is over. Communicate to them that this is not a disciplinary measure and document it. This step can protect you if the employee claims they were treated unfairly.

 

Brush Up on Protocol

 

Reread the company’s policies surrounding ethics and compliance, fraud and other relevant topics. This can help you determine what law or policy the fraudster violated. Then, prepare for the investigation by reviewing the organization’s fraud investigation procedures. Download document templates (e.g. investigation report, investigation plan) to get organized faster.

 

Find out how case management software can help you conduct better fraud investigations in our free eBook.

 

Plan the Investigation

 

If you want your fraud investigation to be a success, you can’t go into it without a plan. Get your team on the same page regarding the investigation’s goals, methods and deadlines. Keep in mind that your plan is subject to change as the investigation progresses.

 

Determine the Scope

 

Identify exactly what you are trying to learn through the investigation. Keep the scope as narrow as possible to protect innocent people. Having a clearly-defined scope not only keeps the fraud investigation on track, but also ensures that it is fair and compliant.

Figure out which authorities or regulators you’ll need to report to if you determine fraud has occurred. This step helps you set a timeline and investigation strategy.

 

Outline Your Strategy

 

A clear strategy ensures you don’t miss any key information or duplicate efforts. As you create your investigation plan, ask:

• What do I already know?
• What do I need to find out?
• Who will I ask for information?
• What documents do I need to review?
• What methods will I use to prove or disprove the allegation?

 

In other words, what do you need to do to investigate who did what actions, and in violation of what? When, where and how did they do it?

 

Make an Interview List

 

Next, make a list of individuals who could offer insight into the suspected fraud. The suspect’s colleagues, friends and family may be able to provide motive, background and other information that corroborates or contradicts the allegation. Experts such as forensic accountants and data scientists can help you figure out how the fraud was committed. Interview the suspect last.

 

Create a Timeline

 

Finally, set deadlines for each stage of the fraud investigation, including interviews, document retrieval and reaching a conclusion. Assign tasks to members of your investigation team. Work fast to increase your chance of recovering losses and decrease the risk of losing evidence.

 

RELATED: Corporate Fraud Prevention: The Ultimate Guide

 

Conduct Strong Interviews

 

According to investigation expert Meric Bloch, “interviewing is usually the most important part of any investigation.” This is the stage when you gather the information you need to draw a conclusion from first-hand sources.

It’s a good idea to have a second investigator or an assistant in the interview to take notes, so that you can concentrate on the interviewee. Many investigators record interviewers, while some feel this can make the interviewee nervous.

 

Start With an Explanation

 

Begin each interview by explaining what will happen and what you expect of the interviewee. This allows you to stay in control while putting their mind at ease. Explain that their answers will be kept confidential wherever possible. Assure them that they’ll be protected from retaliation.

 

Use an Interview Outline

 

While you may be tempted to use an interview script, opt for an outline instead. Bloch emphasizes that the interviewee’s answers, not the questions, are the evidence, so your wording isn’t as important as the information you receive. Plus, an interview allows the conversation to flow more naturally than a rigid script.

 

Build Rapport

 

Interviewees are more likely to open up to a friendly person. Make them feel comfortable and thank them at both the beginning and end of the interview. No matter what information they provide, keep a positive attitude.

 

Download our cheat sheet to learn tips for building and maintaining rapport.

 

Phrase Questions Carefully

 

First, set a baseline with easy questions, such as “What is your position at Company XYZ?” Ask open-ended questions to avoid leading the interviewee. Use clear, plain language and make sure your questions are straightforward.

Review Records

 

In addition to gathering information through interviews, you must review records, documents, photos, videos and other evidence. Records provide hard facts that interviewees may forget or intentionally withhold.

 

Review Email Records

 

Looking through the accused person’s work and personal email histories may reveal signs of fraud, such as large bank deposits or complaints about their finances. If there is more than one suspect, read their correspondence with each other to find evidence of a fraud scheme.

 

Look at the Personnel File

 

Next, review the suspect’s personnel file. Do they have weeks of unused leave? Have they asked for advances on their pay? Has their performance declined? All of these could be indicators of fraudulent behavior. However, be careful to only present the facts of this evidence, not inferences or judgements, in your investigation report.

 

Only Review Relevant Documents

 

When analyzing documents, only review those that fall within the scope of your investigation. Documents provide a snapshot of the time they were created, especially emails. For this reason, reviewing documents outside the scope of your investigation could muddle it. Sticking only to relevant records keeps your team on track and reduces your liability.

 

Retain Copies of Documents

 

As you investigate, keep copies of records on hand to review again. Retaining copies allows you to make notes on the documents without damaging the originals. If you use a case management system, you can organize all of the investigation information, including interview notes, records and other evidence, right in the case file.

 

RELATED: 5 Internal Audit Red Flags that Should Trigger a Fraud Investigation

 

Analyze Evidence

 

Now that you’ve gathered evidence, you must assess if you have enough information to draw a conclusion. Have you found enough facts to guide your organization’s decision-makers in correcting and preventing this problem? In fraud investigations, you can’t afford to determine the case inconclusive.

 

Determine Quality

 

Analyze the evidence you’ve gathered. Bloch stresses that you should only use evidence for fraud investigations if it is:

• concrete
• specific
• relevant to the investigation
• competent
• authentic

 

If a piece of evidence doesn’t meet those standards, don’t use it when drawing a conclusion.

 

Keep Evidence Secure

 

Confidentiality is key for any investigation, but especially important in fraud cases. Lock up physical evidence. Protect digital information by encrypting files or using a secure case management platform with role-based access.

 

Are you currently using online tools to aid in your investigations? Solid online research skills can make your investigations more thorough and efficient. Watch this free webinar to learn helpful techniques and tools for gathering information you need online.

 

Separate Facts and Opinions

 

As an investigator, it’s your job to uncover facts, not make judgements. When drawing a conclusion, use only objective facts, not inferences (what you assume based on a fact) or opinions (subjective beliefs you hold).

 

Check Evidence Against the Allegation

 

The goal of a fraud investigation is to prove or disprove each element of the allegation. Did the alleged behavior occur? Did the alleged fraudster do it? If you can’t achieve this with the evidence you’ve gathered, keep working until you can.

For instance, the allegation states that Bob stole money out of till 4 on March 31. The work schedules you’ve reviewed prove Bob was working at till 4 on March 31, and security footage you’ve used as evidence shows Bob opening the till, removing funds and slipping the cash into his pocket.

 

Write the Final Fraud Investigation Report

 

“A well-written report, because of its reliance on facts and not speculation, shows both that you have done your job and that you met your responsibilities to the company,” explains Bloch. Your fraud investigation report should be simple, factual and limited by the scope of your investigation.

An investigation report should include facts and analysis of the evidence, a determination and recommendations for corrective action. However, avoid drawing legal conclusions; leave that up to the appropriate authorities instead.

 

Avoid Inflammatory Language

 

The final investigation report should present facts, not your opinions or judgements. To keep it objective, avoid using words like “presumably” or “supposedly.” Don’t use inflammatory or negative language. For example, say “Bob looked around the room and would not make eye contact” rather than “Bob seemed nervous and shifty.”

In addition, never say that your determination is an outright fact. Instead, report that the investigation determined the elements of the allegation. For instance, “The investigation determined that Bob created a fictitious vendor profile for XY Office Supplies. The investigation determined that Bob wrote a check for $2,000 to XY Office Supplies. The investigation determined that Bob deposited a $2,000 check made out to XY Office Supplies into his bank account at World’s Best Bank.”

 

Use Direct Quotes

 

Another way to ensure your investigation report sticks to the facts is to include direct quotations where possible. Take thorough notes or record interviews (with consent) so you can include as many quotes as possible. If the accused person confesses or admits to fraud, report exactly what they said.

 

Limit Jargon

 

Limit your use of jargon, acronyms and technical terms. If you must use them, define each word or phrase the first time you use it in the report. Your fraud investigation report should be able to stand on its own without supplementary documents or knowledge. If it doesn’t, simplify and edit until anyone could understand it.

 

Refer to Documents

 

Finally, describe records you used as evidence and the facts that you found in each one. Reference organizational policies and procedures that were violated by the fraudster as well. Include copies of each of these documents with key passages highlighted, too.