Finance Forensic Accounting Investigation

Financial fraud is the deliberate act of deceiving or misrepresenting financial information, transactions, or assets in order to gain money, avoid losses, or mislead others; common examples include accounting fraud, where financial statements are falsified, investment fraud such as Ponzi schemes, insurance fraud through false claims, credit card fraud using stolen card details, and embezzlement, where someone steals money entrusted to them. Other examples include appropriation of assets,  fictitious transactions, false invoicing and the falsification of accounting entries. Whereas, a Fraud Investigation is the process of examining financial records, transactions, and evidence to detect, analyze, and prove whether fraud or other financial misconduct has occurred, often for legal, regulatory, or dispute-resolution purposes. The purpose of this article is to inform the reader about the basic stages and principles of a forensic accounting investigation. It presents, on a high level, the approach to be undertaken by organizations during an internal investigation.

Benefits of fraud investigations

Organizations conduct internal fraud investigations aimed to assist in the detection of improper or unethical conduct, in the identification of those responsible, in stopping ongoing fraud, and in, ultimately, deterring any future misconduct.

Fraud investigations may also be of assistance in estimating any losses incurred as a result of a fraud that was not detected timely, quantifying future exposures, supporting in the recovery of misappropriated funds or assets, mitigating any wider legal, operational, and reputational consequences, and identifying as well as remediating internal control environment weaknesses. That is the weaknesses that enabled the fraud to go-on undetected and happen in the first place.

Fraud Investigation Methodology

A fraud investigation is a structured, legally permissible way to investigate warning signs, indications or allegations of fraud from the moment of first suspicion until final resolution. It is often the case that full facts are unclear initially, as a result the investigator, be it an internal auditor or any other adequately trained professional, follows a step-by-step process that begins with broad information and gradually narrows down to specific details, documenting evidence and the thought process along the way. The ultimate target / goal is to find out what happened, who was involved, and what actions or improvements may be needed.

Triangulation / Multi-perspective Approach

In a fraud investigation, the investigator must stay objective, avoid jumping to conclusions and attempt to triangulate any hypotheses made and considered. The investigator must gather evidence of the suspected fraud, while also testing whether the facts and outcome may be supported by alternative explanations.

Specifically, triangulation in a fraud examination refers to verifying a suspicion (i.e., hypotheses) using multiple independent sources so reliance is not placed on just single piece of evidence, but on multiple perspectives that are also being tested. For example, as to uncover a potentially fake vendor, you match invoices and payments (accounting records) with proof of delivery/service (operational records) and external checks like vendor registration/address/bank details. Alternatively, for expense fraud, the investigator may compare the employee’s claim, receipt authenticity, and card/bank transaction logs. Any mismatch between these sources is a major indicator of potential fraud risk.

This balanced approach reduces the risk of rushing to judgments or conclusions and helps ensure that multiple reasonable scenarios have been considered.  This multi-perspective approach is also crucial for any subsequent legal action taken as a result of the investigation as the standard of evidence in courts differs. For example, fraud must be proven beyond a reasonable doubt in criminal court, and usually by clear and convincing evidence (sometimes preponderance of the evidence) in civil court which demonstrates a proposition is more likely true than not true.

Fraud Response Plan andInvestigation Planning

When indicators of misconduct arise, management must act promptly, as the initial response can significantly influence the overall outcome. Accordingly, organizations are advised to establish a fraud response plan as a clear and practical framework outlining the appropriate actions to take when fraud is suspected. Although such a plan does not prescribe every step of a full investigation—given that each case presents unique circumstances—it helps ensure a consistent and effective response, mitigates risk, and enhances the likelihood of a successful resolution. Moreover, a well-defined plan demonstrates to employees and stakeholders that leadership treats fraud prevention and response with the utmost seriousness. A fraud response plan, typically, outlines how concerns should be reported, who will perform the initial assessment, how key decisions will be made, how to preserve important records / evidence, how actions will be documented. It is often the case that a fraud response plan also includes a standard form for reporting fraud incidents. All in all, a fraud response plan is a documented, step-by-step procedure an organisation uses to detect, investigate, contain, report, and remediate suspected fraud. It also includes when to involve legal, HR, auditors, regulators, or law enforcement in the process.

Without a fraud response plan, organizations often respond in an uncoordinated way, waste time and resources, ultimately leading to greater damage, both monetary and non-monetary. Once it is decided that an allegation will be investigated, those responsible should develop a detailed investigation plan with input from all relevant team members. This planning should start early and possibly adjusted along the way as the investigation continues and new facts or evidence emerges. Because every fraud investigation is unique, the plan should be shaped by the specific circumstances, but it helps to begin with a standard checklist reviewing what is known, defining objectives, identifying who must be kept informed, setting scope and timelines, considering law enforcement involvement, assigning roles and tasks, addressing operational issues, outlining the course of action, ensuring the necessary resources are available, and preparing the organization for the investigation.

Evidence handling

When managing an incident, the persons conducting the investigation must ensure that the alteration of the collected evidence is prevented, and that the integrity and confidentiality of the information and/or documentation collected as part of the forensic investigation is maintained. It is necessary to isolate and secure physical and digital data, record all evidence in detail, and apply appropriate controls. From the moment evidence is sourced or received in a forensic accounting or fraud investigation, its chain of custody must be maintained so it can be utilized in court proceedings.

Chain of custody refers to both the process and the keeping of written records, similar to physical inventory controls, that show who had possession of an item, when they had it, where it was stored, how it was transferred, and what was done with it. Chain of custody records help prove the authenticity of evidence and that the evidence has not been altered during the time period that has passed from initial collection / sourcing until presentation in court. To establish this, examiners / investigators should document every time evidence is received or leaves their control, ideally with a memo that states what was received, when, from whom, and where it will be kept, and they should record any later handovers in the same way. Each item should also be uniquely identifiable later. An example for this could be initialling and dating evidence, using a discreet mark for original business records, or sealing it in an envelope that is then initialled and dated).

Reporting

After the fraud examiner / investigator gathers and reviews the evidence and prepares findings report, results must be shared  with the appropriate persons. These people can be  management, the board of directors, or  an  audit committee of the entity. A fraud investigation report / findings report explains what the examiner / investigator did, what they found, and sometimes what they recommend as next steps. Next steps should be actionable, as a result, the appropriate decision makers should be informed. When reporting, the examiner / investigator must be clear / concise, accurate, and neutral (unbiased), having in mind that the findings report may be read or used by a diverse set of persons may it be employees, lawyers, suspects, victims, witnesses, juries, judges, and even possible the media. The conclusion section of an investigation report summarizes the findings by stating whether each allegation is substantiated, unsubstantiated, or inconclusive. It must clearly link the final determinations to the collected evidence and credibility assessments without introducing new information.

Sources

2017 - CFE - SM 1.pdf (Fraud Examiners Manual 2017) 

Published in icpac.org.cy