Best practices for when you suspect employee fraud

When a fraud is detected, the first instinct among business leaders may be to cut out the cancer immediately, firing the responsible employee on the spot to prevent further harm to the organization.

While such a move may be satisfying for company owners and executives angered by an employee’s betrayal, it can increase short- and long-term fraud risk for the organization and create significant obstacles for forensic investigators and law enforcement.

In-house and outside lawyers can help reduce a client’s risk by counseling restraint and bringing aboard forensic specialists and legal counsel with the skills to fully investigate and uncover fraud. Complex financial cases require interviewing skills, technology prowess and specific legal knowledge. They can involve several employees, outside contractors and vendors. And they may have been underway for months or years, with tentacles stretching into unforeseen corners of a business.

Hasty moves at the outset of the discovery of improprieties can inhibit the ability of a forensic investigation team to secure data and gather information from suspected employees. Co-conspirators may use this time to cover up their involvement—or they may feel empowered to continue their schemes if they see the company has mishandled the investigation.

A deliberate investigative approach can increase the odds that all perpetrators are caught and that a solid case can be brought against them. Caution can also help executives and counsel avoid costly mistakes around employee terminations and help the company gain critical knowledge about the steps it needs to take to prevent fraud from occurring again.

Without question, company and counsel should move quickly if they suspect fraud. Yet the first moves should be about assembling and deploying a forensic investigative team and preserving the chain of evidence. In fact, the faster they move on these issues, the better.

Don’t fire the bad guy—yet

In this article, we review how keeping a bad actor on the payroll—for a time—can assist an investigation. We also discuss methods used by forensic investigators to extract information from fraudsters and highlight best practices for counsel and clients launching a fraud investigation.

Why should an organization keep a fraudster on the payroll—even temporarily? Put simply, gathering information from employees is far easier while they are on the payroll. As long as they are active employees, they have a duty to cooperate and can be interviewed by the fraud investigator, and those interviews can be crucial in obtaining evidence and even a confession. Once employees are let go, their duty to the company and their desire to help their former employer can dissipate almost instantly.

When questioned by a fraud investigator, the employee may fear that failing to answer questions or respond to requests may put his or her job at risk. This leverage is a key arrow in the investigator’s quiver, and gives them the ability to seek information from employees that may be difficult for law enforcement to easily obtain. For instance, where law enforcement may be required to seek a warrant to obtain bank records, a fraud investigator can simply ask an employee for their personal financial information.

Likewise, to compel an interview, law enforcement might be forced to arrest an employee and read them their Miranda rights. The employee is then likely to retain an attorney and to assert their rights against self-incrimination—thus complicating efforts to gauge the depth of a fraud scheme or to root out co-conspirators.

Provided they are working independently of law enforcement, however, a fraud investigator does not have a duty to advise the employee of his or her Miranda rights. So long as they are conducting a lawful investigation and employees are not held against their will, fraud investigators can merely request the accused to submit to an interview ‑significantly simplifying the collection and development of evidence of a fraud scheme.

The psychology of fraudsters

For counsel, a fraud investigator’s ability to gather information without law enforcement power, like a warrant or subpoena, can come as a surprise. Yet skilled investigators are able to deploy an array of interviewing techniques to help elicit responses.

During the interview process, for instance, investigators commonly start with a set of general questions, developing a rapport and making employees more comfortable with the process. As the conversation proceeds, the questions turn to more specific—and sensitive—issues.

A trained forensic investigator also understands the psychology of most occupational fraudsters. Employees who have been involved in a long-running fraud routinely feel guilty about their actions and may cooperate when confronted with fraud accusations, in an attempt to clear their consciences. In our experience, fraudsters often talk even if it does not seem in their best interest to do so.

In one recent case, we investigated a bookkeeper who was suspected of embezzlement at her company. When interviewed and asked to turn over her bank records, the bookkeeper not only acknowledged the fraud, but downloaded her financial information and turned it over to the investigative team. The records proved that she had benefitted from the scheme, and she was indicted shortly thereafter.

By developing a conversational rapport with the bookkeeper and giving her a chance to assuage her guilt, the investigative team was able to wrap the case in a bow and turn it over to law enforcement for a swift and successful prosecution.

The tip of the iceberg

Gathering information from the suspected employee is crucial, not only to stop illegal activity but to determine whether others are involved. As an investigation commences, company and counsel should proceed as if the issue they have detected may be just one part of a larger scheme. It often is.

By adhering to an investigative process, proceeding calmly and rationally, and deploying a team of skilled forensic investigators, they may even discover issues they had not even anticipated.

Recently, we were engaged by a professional services firm to look into a nagging financial issue. A line of credit, which had normally ebbed and flowed over time, had experienced a prolonged period of continuous growth. Executives had no reason to suspect wrongdoing. They were baffled by the line of credit’s performance and knew a deep, forensic dive was required.

During the probe, we discovered that the line of credit was at the center of a fictitious revenue scheme and financial statement fraud in excess of $4 million. We also identified another $4 million in questionable revenue that may have been the result of wrongdoing by employees or that may have been caused by poorly implemented accounting procedures. Whatever the case, the decision by executives to invest in a forensic approach brought to light significant misconduct and highlighted areas where the company needed to clean up its financial systems.

A circle of trust

Engaging in a deep investigative process can be unsettling for an enterprise. In a smaller, closely held company, in particular, an owner may see employees as extended family and feel deeply betrayed and angry when fraud is uncovered.

In those moments, they may speak to trusted employees and discuss more details than they should about the course of an investigation. Unfortunately, those trusted employees may be involved in the fraud, and the tip-off from the owner has given them an opportunity to cover their tracks.

The investigative process requires discipline around the flow of information among executives, counsel and investigators. Only those who are on a need-to-know basis—preferably senior company leaders—should be informed about the investigation. Optimally, one or two executives will take the lead, hiring the forensic team and making decisions about the conduct of the inquiry.

Keeping the circle of trust as small as possible will help prevent news from spreading quickly through the company ranks and will give investigators a greater opportunity to catch fraudsters before they have time to destroy evidence.

No time for DIY

A complex financial fraud investigation is best handled by specialists with expertise in forensic techniques. They should be skilled at conducting interviews, able to spot inconsistencies and patterns in reams of financial data, have a deep understanding of how to extract data from complicated technology systems, and an ability to develop evidence to complete the circle from conversion to benefit—all while preserving a chain of custody for law enforcement.

Either a lack of understanding about the investigative process or cost issues can sometimes drive organizations to engage their current outside accounting firm to handle an investigation. Counsel might advise them to resist the temptation.

A traditional accounting firm may excel at conducting the company’s regular audits, but it rarely is equipped to handle a complex forensic investigation. Furthermore, its close relationship with the company—and its connection to the company’s financial record keeping—may pose a conflict of interest.

In one recent case, a company hired its regular accounting firm for a forensic investigation involving an employee accused of financial fraud. Lacking the skills necessary to conduct such an investigation, the accounting firm flubbed interviews and failed to get to the bottom of the fraud. Worse, the botched investigation allowed the employee to file a defamation suit against the company. The company’s decision to hire the firm, a cost-savings measure, left it in greater legal and financial risk than when it started.

If hiring the wrong kind of accounting firm can derail an investigation, a do-it-yourself approach can cause even greater damage. Investigative techniques, such as interviewing, require great skill and precision. Company owners and executives generally trust their co-workers and may feel constrained from pursuing tough questioning. And in-house accounting and IT teams may not have the financial and technology prowess necessary to gather useable evidence of wrongdoing.

Perhaps the most vulnerable category of businesses in this regard are professional services providers, especially doctors and lawyers. While experts at treating patients and representing their clients, they are often less experienced in managing businesses. Because of this, they sometimes take matters into their own hands—with predictably unfortunate results.

The right team

To avoid problems, a team of advisers with complimentary skills is necessary to manage a complex financial investigation.

The team should include:

• a financial investigator, such as a certified fraud examiner, who has experience collecting, analyzing, and presenting evidence and who can maximize the efficiency and effectiveness of the investigation.
• a computer forensics specialist, who can ensure that digital information—often the linchpin of modern financial investigations—is properly collected and handled. A computer forensics specialist will deploy forensically sound methods that are unfamiliar to most corporate IT professionals and is trained to recover and preserve critical digital evidence.
• attorneys well-versed in white-collar criminal law and employment law. A white-collar specialist can be crucial in developing and executing a plan from investigation through resolution. Employment counsel can assist with questions of employee-versus-employer rights and help avoid mistakes that may lead to defamation and wrongful termination cases.

Hiring a specialized team of forensic investigators and counsel to conduct an investigation does not come cheap. Yet it can be far less costly to hire the right professionals than to suffer through the expense of a botched investigation.

Immediate steps

Once a professional investigative team is assembled, the organization should take a series of immediate steps to help investigators capture information and to prevent further financial losses. Counsel should advise clients to:

Secure potential evidence. The company should move as rapidly as possible to safeguard any data that can assist investigators and serve as evidence in a prosecution or civil suit. This includes securing electronic devices such computers, thumb drives, discs, cell phones, and related software and storage programs, as well as the employee’s physical workspace.

Avoid inadvertently destroying evidence. Executives may feel the urge to examine a suspected employee’s electronic files, or an IT staff member may shut off or connect an external device to a computer. These actions can render the devices useless as evidence, as they have been altered from their original state. Instead, a computer forensic specialist can and should mirror hard drives and carefully search for relevant data in a way that preserves the chain of custody.

Restrict the employee’s access. After an employee has been notified that they are the target of an investigation, their access to company information systems should end. Passwords should be deactivated, and the employee should not be allowed to touch or remove anything from the office. The employee should also be accompanied while in the office and escorted from the premises.

Notify the insurer. Most insurance policies carry a 30- or 60-day notification provision from the first day a potential loss has been discovered. Failure to notify the insurer can result in a loss of coverage. Once the insurance carrier is notified, a proof of loss must be filed within a specified time frame. Do not be afraid to ask for extensions to ensure proper documentation of the claim.

Solving an expensive problem

Fraud committed by individuals against employers is one of the costliest—and most common—forms of financial crime. According to the Association of Certified Fraud Examiners’ 2020 Report to the Nations on occupational fraud and abuse, companies lose an estimated 5 percent of their annual revenue to fraud. The average loss per fraud case for the businesses studied was more than $1,500,000, and typically, those frauds lasted for more than a year before they were detected.

As they advise clients who suspect or who have detected a fraud, counsel can help them make calm, careful and rational decisions that will assist the investigative process. In doing so, they can improve their client’s chances of recovering losses, uncovering the full scope of a fraudulent activity, and preventing future frauds from taking root.

Kelly J. Todd is a managing member and the member in charge of forensic investigations at Forensic Strategic Solutions, LLC. In her work as a forensic accountant and fraud examiner, Ms. Todd works closely with defense and plaintiff attorneys, audit committees, corporate boards, and government inspector generals.