Despite their best prevention efforts, your clients are likely to suffer incidents of occupational fraud. When they do, they’ll need the assistance of a fraud expert, perhaps to find the perpetrator, or at minimum to collect evidence.
A joint guide, Managing the Business Risk of Fraud: A Practical Guide, published by the American Institute of Certified Public Accountants (AICPA), the Association of Certified Fraud Examiners (ACFE) and the Institute of Internal Auditors (IIA), outlines the approach a qualified expert will take to execute an effective and coordinated fraud investigation. By understanding how your expert will conduct the investigation, you can ensure you’re providing the information and assistance necessary for it to be successful.
Fraud investigations involve a variety of steps designed to protect the business, minimize disruptions and preserve evidence. According to the joint guide, every fraud investigation should include a process to:
Work with your expert and client to determine the appropriate process for the particular matter at hand. The client must grant the expert sufficient authority to conduct the investigation and work with internal departments — including human resources, in-house counsel, senior management, IT, internal auditing, and security and loss-prevention.
Thorough planning is a prerequisite to launching a fraud investigation. The plan developed by you and your expert should prioritize investigatory tasks to facilitate an interim report of findings (if required), but also allow for revision. Tasks typically belong to three primary stages:
1. Interviews. The expert will interview third-party witnesses, corroborative witnesses, possible co-conspirators and the alleged perpetrator or perpetrators.
2. Evidence collection. To gather relevant evidence, the expert will target both internal documents and external records. The former includes personnel files, internal phone records, e-mail, financial records, security camera tapes, and physical and IT system access records. The expert may need to perform computer forensic examinations to locate this evidence. External records could include public records, customer and vendor information, media reports, and private detective reports.
3. Evidence analysis. The expert will review and categorize the information collected, conduct computer-assisted data analysis and test various hypotheses. He or she will document and track every step in the investigation. Appropriate documentation covers privileged or confidential items; requests for documents, electronic data and other information; memoranda of interviews; and analysis of documents, data, interviews and conclusions drawn.
The expert also will provide a report of his or her findings. You may determine the appropriate format for the report and how distribution will be affected by the need to protect legal privileges and avoid defamation.
To minimize its legal liability, a company must take some corrective action in response to an expert’s fraud findings. When necessary to maintain confidentiality, preserve evidence or mitigate losses, the company may even consider taking action before the investigation is complete. It might, for example, suspend or reassign an employee or commence legal action to restrain specific assets.
After the expert has completed the investigation, the company can make a criminal referral and may even be required to do so by law. Alternatively, the company might pursue civil litigation, impose disciplinary action, file an insurance claim, extend the investigation, or revise business processes or internal controls.
Every company should take a proactive stance toward risk management to minimize its exposure to fraud losses. But when fraud slips through the cracks, a qualified expert can help ensure a timely and comprehensive investigation.
Managing the Business Risk of Fraud: A Practical Guide notes that consistency in investigatory processes is important, but it recognizes that several factors will influence the plan for a specific investigation. For example, in the case of time sensitivity, deadlines may be imposed by legal requirements, the need to mitigate losses or harm, or insurance claims restrictions.
Other factors that may influence the investigation plan include:
Notification. The company may be required to notify regulators, law enforcement, insurers or auditors.
Confidentiality. The investigation must ensure confidentiality for certain collected information.
Legal privileges. The company’s attorney and the expert must agree in advance on the proper measures to protect work product and attorney-client communications.
Compliance issues. The investigation must comply with applicable laws and rules regarding the gathering of information.
Charlie LeBoeuf, CPA