Building a case: fraud investigations need to start with a plan for gathering and handling the evidence.

Fraud investigations need to start with a plan for gathering and handling the evidence.

What do you do when a senior vice-president in your company is suspected of fraud? How do you handle an investigation that involves your president's faithful and trusted executive assistant? And where do you turn if your investigation implicates a top sales executive?

Fraud investigations are not only challenging; they are usually emotionally charged. They can cause great anxiety and personal conflict, and not just for the guilty offender. An internal auditor's involvement with a fraud case usually ends when the fraudulent activity has been identified and management has been notified; but, in some instances, internal auditors may also be called on to handle the actual investigation. If you're the internal auditor responsible for a fraud investigation, you may sometimes get the uneasy feeling that you're walking on extremely thin ice.

Despite the tension and angst that can occur, for example, when you have to investigate a long-term fellow employee with an outstanding track record or with powerful allies among top management, you must remain clear-headed enough to conduct an effective and impartial examination of the facts. Internal auditors performing fraud investigations must be sure that the evidence they uncover is complete, secure, organized, and in compliance with the requirements of the legal process.

A plan for managing the investigation and evidence can provide significant stability to a shaky situation. Knowing how to prepare for the investigation and how to secure and manage documentary evidence appropriately will be invaluable to internal auditors in finding the truth and building a case.

* Preparation

As with any project, advance preparation is the key to success. Time invested before the investigation actually begins will save worry later. Proper fraud investigation preparation should include the following steps:

Establish standard procedures.

Internal investigations often involve emotional turmoil; and it's common for a suspect to express denial, indignation, and even outrage at the implication behind an internal auditor's questions. Internal auditors should, therefore, encourage their companies to establish a formal policy on corporate fraud.

The policy should describe the procedures to be followed in every investigation -- without exception. The internal auditor can then assure the suspected individual that the questions and actions taken are completely in line with an existing policy that applies to all employees.

Define lines of responsibility.

To avoid duplicated effort and oversights, it's important to define who is responsible for what, right from the start. General counsel will typically be part of the investigation team from the beginning. In some circumstances, the investigation will also require the involvement of the company's security officer. Usually, the internal auditor is concerned mainly with the accounting side of the alleged fraud, but the lines of authority and responsibility can become blurred in some instances. Generally, it's advisable to be as specific as possible in defining responsibility.

Consider hiring an outside consultant.

Many senior executives call on outside expertise as soon as they find themselves facing a suspected case of fraud. Professional consultants, who may have highly specialized experience in forensic and investigative accounting and other areas, can work with the internal auditors, lawyers, and security officers. Consultants may help in establishing overall strategy, specific procedures, and individual responsibility.

Establish reporting lines to a senior executive.

Internal auditors play a vital corporate role, and it's imperative that they receive the support of top management in their efforts to protect the interests of the organization. When the internal auditor reports directly to a senior executive, for example, fraud investigations are less likely to be sidetracked, even if the investigation implicates an employee with friends in high places.

Document Management

A plan for managing all aspects of the documentary evidence uncovered in the investigation must be developed as early as possible. This is particularly true if the suspected wrongdoing involves a complex trail of financial transactions.

In most cases, establishing a document management plan will be one of the first steps in the investigation. That way the members of the investigative team will be able to decide which documents will best achieve the strategic goals of the investigation. Any document management plan should provide for the following:

Document Security

A key priority in document management is to preserve the integrity of all evidence. Most fraud evidence is in the form of working papers, correspondence, and original documents, such as bank statements, checks, customer records, accounting documents like inventory records and ledgers, corporate taxation returns, and computer information.

Original documents should be secured as soon as they are seized and stored in locked cabinets or safes accessible only to members of the investigating team. If several keys to these cabinets or safes are in circulation, the locks must be changed.

Documents are likely targets for destruction by arson or theft and, therefore, may need to be stored off-site. The documents can also be copied and inventoried, which will also aid in the identification of any documents that have not yet been obtained. The search for additional evidence will be an ongoing task, so an up-to-date inventory of all seized documents is a great help.

To help maintain a high level of confidentiality, all working notes and correspondence generated by the investigating team should also be kept in a secure place. Doing everything possible to keep the investigation confidential is important because it helps to protect the reputation of the suspected person. In addition, confidentiality helps ensure that the investigation proceeds unhindered and allows counsel to develop a strategy for any anticipated legal action.

Any information about the investigation that is generated or stored on a computer should also be safe-guarded. There's no point in locking physical documents in a cabinet each evening if the investigators' computers holding information about the investigation remain accessible to everyone in the office. It's a good idea to use password protection for all of the investigators' computer files related to the investigation. Using a personal computer that can be locked away each night is an even better solution. A regular back-up of all investigation files should be made and stored in a separate secure location.

In addition to securing computerized information about the investigation generated by the investigators, computer evidence linking the suspect to the crime must also be safeguarded. Computer records are often crucial to the successful completion of an investigation, and the first step to securing such records is to make absolutely certain that the suspected person does not retain access to computer information. This would involve changing the passwords on all relevant files, including network files and modem facilities. Care should be taken, however, to guard against any action that might cause undue damage to the suspected individual's reputation.

In most companies, regular employees will need to retain daily access to the information contained in the organization's computer system. So that the information necessary to the investigation will remain unaltered and available to the investigators, a back-up of all relevant computer systems should be made, and a duplicate copy of the back-up should be stored with the original documents.

Continuity of Evidence

It's always a good idea to assume that any document related to the case will be used in court. To be admissible, the document must be genuine and in the same condition it was in when seized. The site from which each document was seized should be recorded, and no marking, stapling, or hole-punching of the original documents should occur.

In addition, a clear chain of custody for each document must be demonstrated. All original documents must be uniquely identified, copied, inventoried, and stored in a secure place. If an important document lies around in somebody's in-tray for several days, its authenticity may be challenged.

Destruction of Obsolete Documents

It might seem obvious, but all discarded or otherwise obsolete documents related to the investigation should be destroyed by shredding. They should never be simply dropped in a wastepaper basket. It can be painfully embarrassing to see the details of a confidential memo or report splashed across the front page of the local newspaper. This kind of carelessness can also lose cases, provoke lawsuits, and end careers.

Document Database

A simple investigation can often involve hundreds of documents. In more complex cases, investigators may be working with several thousand pieces of evidence. The key in all cases is to file each document in an organized way so that information can be readily located as needed. A manual document management system might serve the purpose in a small investigation; however, a computerized database system is usually more efficient and effective. The system should be selected based on the anticipated number of documents, the interrelationship of the various documents, and the complexity of the investigation.

The benefits of any document management database should obviously be weighed against the costs, which will include database development, data input, and ongoing database maintenance. To help make a final choice, the search, retrieval and display, and database access requirements will need to be determined in advance. Another option worth considering is transferring entire documents into machine-readable form using document imaging.

Setting Up the Database

The first step in setting up a document database is to identify the types of documents involved, the key documents, and any generic document terms that can be used to standardize referencing. Next, a general index of the documents should be created.

For smaller investigations, a flat file database, such as a spreadsheet, might be used to list all relevant documents and where they are filed. However, more complex investigations involving large numbers of transactions, funds tracing, or the identification of relationships between companies or individuals will most likely require the use of a relational database, which can create links between two or more pieces of information.

The Chronological Database

One useful relational database is the chronological database, which is particularly valuable at the start of an investigation when it's hard to determine which documents will be relevant. A basic chronological database will help the investigating team compile a timeline of events, people, companies, and places associated with the alleged wrongdoing. By sorting the recorded information so that the date and time of movements of funds can be identified, a sophisticated chronological database can even help investigators establish links between transactions in different locations and currencies.

Final Reports

The final aspect of document management is compiling everything in some type of report. Investigators must communicate their findings so that a reader or listener will understand the information and how the investigators reached each conclusion.

Not every investigation calls for a formal final report, however. Sometimes an affidavit, an oral report, or a reporting letter will do the job. Regardless of the actual format, any time litigation is anticipated the report should be reviewed by legal counsel to ensure that it is appropriate for court presentation.

In cases that involve the presentation of many documents at a trial, legal counsel should be consulted to help investigators prepare a document brief for the convenience of the court. This should contain unmarked copies of all the original documents that may be presented as exhibits. It's not an exhibit itself, but a document brief can save valuable time when the judge and jury need to refer to various original documents during the trial.

Final Precautions 

Although investigation preparation and document management are essential strategies in fraud investigations, the internal auditor must be aware of other actions that can help to achieve an effective inquiry. For example, maintaining good communication among all members of the investigating team will be critical. During an investigation, no investigator ever wants to get into a situation where he or she is working in the dark. Ideally, the investigator in charge of evidence collection should participate in all meetings related to the assignment. When the president meets with the security officer or the general counsel meets with another member of the team without the investigator's knowledge, for example, problems can occur. Such communication breakdowns can sometimes cause the entire investigation to drift off strategy.

Another familiar point to internal auditors involves privileged information. Internal auditors assuming the roles of investigators should obviously avoid any form of gossip with friends in the organization. Also, investigators should never discuss their cases in an elevator, a taxi, or even when traveling by public transit; and the various people interviewed should be asked to refrain from discussing the investigation with others. These discussions may be innocent, yet they can often result in a common but inaccurate story line.

For most internal auditors, the stress, anxiety, and turmoil experienced in a fraud investigation cannot be completely eliminated. Yet, solid preparation, strong auditing skills, and a carefully considered plan for capturing, recording, and gathering evidence can help to ensure a high level of objectivity and professionalism.