Anatomy of a Fraud Investigation: From Detection to Prosecution

When you hear about fraud today, it is usually in conjunction with greedy Wall Street executives who have cooked their companies’ books in order to bring big bonuses their way or equally greedy money managers who have swindled their clients out of millions of dollars. The reality though is that fraud and embezzlement cases happen on much smaller scales every day. These crimes can be devastating to companies and are ones that organization leaders rarely know how to handle effectively. Author Stephen Pedneault says that if you suspect fraud at your organization (or even if you don’t!) or if you’re an accountant, auditor or other financial advisor, it’s time you learned how to roll out a proper fraud investigation.

“Fraud is a tricky crime for organizations to uncover because it can be easy to hide, and it can be easy for guilty parties to destroy evidence once it is discovered,” says Pedneault, a forensic account and author of Anatomy of a Fraud Investigation: From Detection to Prosecution (John Wiley & Sons, February 2010, ISBN: 978-0-470-56047-1, $49.95). “If a fraud suspect gets wind that an investigation is coming he can cover his tracks very quickly. Managing the investigative process can be very challenging for organization leaders and even accountants or other financial advisors without the proper experience.”

Pedneault wrote Anatomy of a Fraud to mitigate some of those challenges. In it he chronicles an actual fraud investigation that he conducted starting from the time the initial allegation was received through to the final resolution of the matter.

“Few people know the steps and measures that need to be taken in a fraud investigation,” says Pedneault. “Because smaller cases rarely receive in depth media coverage, it is difficult for people to learn how these types of cases are discovered, investigated, and ultimately resolved. But the reality is knowing these factors are invaluable to anyone with a hand in managing an organization’s finances.”

Anatomy of a Fraud is a valuable resource, whether you are a fraud investigator, auditor, or if you simply suspect fraud may be occurring in your organization and you aren’t sure what to do. Read on for a few tips on how to properly handle a fraud investigation:

Make it easy for whistleblowers to provide tips. According to the Association of Certified Fraud Examiners’ 2008 Report to the Nation on Occupational Fraud & Abuse, tips accounted for 46 percent of all frauds detected. Organizations should educate employees regarding their fiduciary duty to provide information, as well as implement a process for individuals to provide such information. On the receiving end, organizations must implement a system to collect, screen, and process complaints and information when it is received.

Remember, specific laws exist to protect whistleblowers and confidential sources of tips, complaints, and information. One must be familiar with these laws and requirements or run the risk of suffering unintended consequences that could cause more damage to the organization beyond the impact of the fraud itself being investigated, such as retaliation lawsuits or personal safety considerations for whistleblowers.

“A great way to handle this situation is to make sure the true source of the information that initiated the investigation is never learned by the target or disclosed to anyone,” says Pedneault. “It is amazing how many individuals have fallen victim to ‘random audits’ of their financial accounts, only to have their fraudulent activity revealed through these random audits. Actually, in many cases, these are nothing but a ruse to protect how information was actually learned.”

Handle electronic evidence appropriately. Often, users have remote access into the business computer systems and networks, and in some cases have access directly into their individual workstations. Once the computer hard drives have been deleted or physically stolen from the computer, recovering the files becomes much more difficult, if not impossible. Beating suspects to the punch by imaging drivers, making a backup, or taking possession of their computer will provide the best scenario for finding electronic evidence.

“Remote access to the organization’s systems, files, and information will need to be disabled to the target once the investigation has been initiated,” says Pedneault. “Knowing all the means the target has available to gain access will help ensure all points of access have been disabled, preventing the target from secretly accessing and deleting key files and information or worse, stealing company information, such as client and customer lists or trade secrets, before being terminated.”

Be aware of the consequences of a “shock and awe” investigative approach. There are pros and cons to performing unplanned, unannounced visits to locations to investigate fraud allegations. The benefits of this approach include catching individuals in the act and minimizing the risk that information that would have been available goes missing. 

“You would be reckless if you failed to consider the potential consequences of a ‘shock-and-awe’ approach,” says Pedneault. “Individuals beyond those involved in the potential fraud will be equally affected by the disruptions likely to occur due to your actions. Some individuals may become angry or supportive of the targeted individuals, while others may break down and become a resource drain requiring consoling. Often, phones will still need to be answered, transactions and activity will still need to be completed, and answers to questions will need to be provided—and there will be many individuals with many questions both within and external to the organization. If you do choose a ‘shock and awe’ approach, you should carefully consider who you will put in charge of keeping the day-to-day operations of the business up and running as long as possible, and who will be in charge of answering questions from employees.”

Have the right supplies on hand for collecting evidence. Collecting evidence in fraud-related cases tends to be voluminous. Having the supplies on hand will prove invaluable as the information is identified, collected, and preserved. Beyond the boxes and labels needed, you need to consider how all those boxes and computers will be transported to a secure location.

“Space is frequently a big issue, especially secured space, for organizations involved in fraud investigations,” says Pedneault. “Often a significant amount of information is collected in the field, and unless the information is sorted to segregate the pertinent evidence from everything else, evidence can overtake any space the organization has available and any space the organization’s auditor or accountant has available. Segregate the non-pertinent information, document how it was segregated, and prepare to return or otherwise provide alternate storage means for the collected information that won’t be required to support the investigation.”

Get your hands dirty. When searching for evidence, you need to consider all the areas where evidence could be found, including trash bins, recycling bins, shredders, and dumpsters. “In my experience, significant evidence supporting allegations has been found in these areas, as was the case in this matter,” says Pedneault. “While cross-cut shredders would prove to be a challenge for reconstructing shredded documents, the ribbon-cut shredder allows a much easier piecing together of the shredded documents. The large, often blue-colored shredding boxes found throughout the larger organizations don’t require any reconstruction at all, as the documents are slipped into these collection bins intact for future shredding. Collect everything possible, because the information not collected could be lost forever. You can always sort it out later and return what is not needed.”

Choose the interview environment carefully. Picking the interview environment is critical to the success of the interview. “Determining where to interview someone will be based on the goals and objectives of the interview,” says Pedneault. “For example, if you are trying to determine what has been happening in the shipping area of a business, asking employees who work in that area may provide the best source of information. If you talk with them out in the shipping area, they may be more apt to answer your questions on an informal basis, as opposed to sitting across from you in a conference room, a place they have seen only once or twice. Conversely, if you were meeting with a target to seek an admission, you would want the individual out of the environment they control, where privacy and a lack of interruption is achieved. While not every interview will allow time and consideration for where best to meet, when possible, plan to meet in a location based on the goals of the interview.”

Plan ahead for the interview. To ensure an effective interview, you must prepare in advance. Deciding where you and the target will sit, how the room will be arranged, questions to be asked, and issues to be resolved will help ensure nothing is missed during a high stress interview situation. The entire interview doesn’t need to be written out, but a general outline will help ensure all areas are covered prior to ending the interview.

“In many cases, you will get only one chance at an interview, so best to plan as if each interview will be the only interview that will be conducted,” says Pedneault. “You should also consider how you will document the interview. Take notes, and record the interview audio or film the interview so that you have it for your records and review.”

Prepare a “day-after” plan. Planning for business continuity is equally as important as planning for a potential abrupt disruption within an organization undergoing a fraud investigation. Pedneault refers to this as the “day-after” plan. The first part is easy—secure the location, remove the computers, secure all documents and files, and place all the employees on leave. Phase two is much harder but much more instrumental to the future of the organization. Consider things like who will answer the phones, process transactions, make sales, collect payments, and do all the other tasks of running the organization the next day once individuals are placed on leave. Also, how will any transactions be completed without the computers?

“Consideration for communications and employee morale must be part of your day-after plan,” says Pedneault. “What message will be communicated to the remaining employees, to customers, to vendors, to the payroll provider, and anyone else? There will be questions, lots of them, and it is best to have contemplated what will happen the day after and implement the plan to minimize interruptions within the organization.”

Involve law enforcement. In many jurisdictions, police involvement begins with an initial complaint being made, often at the patrol officer level. This may differ depending on your jurisdiction as well as each agency’s approach to these types of crimes. “Generally, once the case is initiated or opened, it is often forwarded to a detective or someone more appropriate for these matters,” says Pedneault. “Once assigned and contact has been established, a meeting is set up to discuss the case, as well as provide much more detailed information.”

Consider how you will pursue restitution and resolution. In fraud cases, victim organizations can pursue criminal charges, civil complaints, or both. There are at least two approaches for pursuing restitution and resolution in these cases. One approach involves the victim pursuing one avenue at a time, such as a criminal case, with the hope that the results of the first means (e.g., a criminal case) will have a positive effect on the others (e.g., civil matter). Therefore, they typically wait on the civil matter until the criminal matter is resolved.

In the second approach the victim organization pursues all options simultaneously, which was the case outlined in the book. A civil case is initiated at the same time a criminal case is launched and the insurance claim is filed. All three channels proceed concurrently, and the fact that criminal and/or civil cases have been initiated may actually help in getting the insurance claim paid.

“My attitude is—why wait on any means of pursuing restitution and justice, if those are goals of the victim?” asks Pedneault. “Be sure to locate and lock down any assets of the target you can before they are gone, as they may be the only means of collecting from the individual. Also, it is not uncommon for the civil and criminal matters to be resolved through one global settlement or agreement.”

 “I won’t give too much away, but I will reveal that the resolution to the case outlined in my book is a positive one,” says Pedneault. “My hope is that by providing this inside look at what goes into a fraud investigation many more organizations will reach positive solutions if they must face the complicated challenge of surviving fraud or embezzlement.”