How to conduct an appropriate fraud investigation

Imagine that your company is being investigated for fraud. One of your employees is caught forging documents, or another is involved in a grand money laundering scheme or "cooking" the financial reporting books. A team of forensic accounting and fraud investigators enters your workplace to conduct a review and investigation. If you found your company under investigation -- how would you handle it?

If you are unsure, then you should know how Deloitte's forensics specialists conduct a comprehensive fraud investigation. It is a carefully planned and thorough undertaking that has to be done right. A poorly executed investigation can make a delicate situation for your company much worse.

Fraud takes on many forms. The Canadian Institute of Chartered Accountants defines fraud as "an intentional act, by one or more individuals among management, other employees, those charged with governance or third parties, involving the use of deception to obtain an unjust or illegal advantage." These activities can include misappropriation of cash or inventory, fraudulent financial reporting and money laundering.

In looking at these activities, Deloitte's fraud investigators take a three-step approach in their investigation: 

• secure and collect all tangible and oral evidence in a manner consistent with the rules of evidence to ensure admissibility
• analyze the evidence, and 
• present the evidence in an understandable manner in a venue of the client's choosing

These stages normally involve using the technology of computer forensic analysis, data analytics and conducting interviews.

Securing and collecting the evidence: computer forensics
The most successful method of detecting improper activities at corporations where fraud is suspected is through the use of technology. Nearly all of a company's information is created and managed electronically, yet typically only a third of that information is committed to paper. The majority of investigations, therefore, require careful searches of electronic information rather than following a paper trail.

Computer forensics allows fraud investigators to uncover more of the facts, support otherwise unsubstantiated information, confirm or refute allegations, and analyze competing theories in relation to those facts. It involves identifying, collecting, analyzing large numbers of data. But without the correct presentation or codification of data, it may not be admissible in a legal proceeding.

Typically, the forensic group would search and analyze:

• Emails
• Documents and files that may be hidden, password protected, or encrypted
• Files that have been generated from the operating system (i.e., enhanced metafiles)
• Databases of all user input and activity
• Recently opened, accessed, created or deleted files, and
• Online activities, including Internet banking transactions

However, electronic evidence is not limited just to laptop and network computers at the workplace. Offsite computer files, servers, and even the head accountant's BlackBerry can prove valuable in an investigation.

If your company is being investigated, it is wise to be as cooperative as you can during the "electronic" phase of the investigation. Computer forensic analysts use sophisticated tools and laboratories to conduct a thorough and accurate investigation. There's really nowhere to hide your data anymore, and any attempts to do so merely create additional evidence pointing toward an attempted cover-up.

Gathering additional evidence through interviews
Successful fraud investigations require interviewing potential witnesses, people with information about a particular infraction, and in some cases, speaking with the suspected perpetrators of fraud themselves. The professional interviewer, therefore, has a detailed and organized plan in place. Knowing this will help you understand how investigators acquire oral evidence. The objective of an interview in a fraud situation is to gather facts related to potential motives on the part of the perpetrator, and to verify opportunities presented to the perpetrator for committing a fraud.

The interviewer carefully organizes the structure of the interview, including its location, attendees, and the series of questions that will be asked. Questions are designed so that they draw out the best possible information from the interviewee. For instance: What will be gained from the interview? What should be known about this individual's activities? Is the interviewee a suspect or just a lead? As well, the interviewer often takes into account body language and certain words and phrases which could indicate deception.

The bottom line
Using computer forensics, data analytics and interviews allows investigators to assemble much of the needed evidence for an investigation. Deloitte's professionals then present the evidence in a way that allows them to make a compelling case if needed.

Going through a fraud investigation can be a stressful time for your company. But you can get through it with cooperation, patience and the right knowledge.