Fraud Triage: First Steps When Fraud Is Discovered

A Solid Checklist to Help Businesses Deal with the Immediate Hours after Discovery of Fraud

The discovery of fraud within a company can be extremely unnerving and can introduce a certain amount of panic in business owners and accounting professionals. Here’s a checklist of things you should be sure to do—from contacting law enforcement and insurers to preserving evidence and communicating with employees.

You’ve just received a call from a loyal client looking for advice—she’s just discovered that one of her employees has been stealing from the company.  Your client has come to you asking for advice—what should I do now that I’ve discovered this fraud?

The word “triage” is often associated with the battlefield process of assigning priority to treating the wounded while the fight still rages on.  While not nearly so dramatic, the discovery of fraud within one’s company can be extremely unnerving and induce a certain amount of panic in the face of a combination of uncertainty as to magnitude and anger at having been taken by a once-trusted employee.

Below is a simple checklist designed to help a business deal with the initial hours after the discovery of fraud in the organization.  This list assumes that the suspected employee has already been removed from his or her job duties:

• Consider hiring a professional investigator experienced in financial forensics: this will prevent company representatives from making mistakes, which can lead to contamination or loss of evidence, or to creating grounds for the suspect employee’s suing the company. 

• Take steps to preserve evidence:  this may be the most crucial, and most overlooked step a company can take upon the discovery of a fraud.  It is essential that all documentation, data, and records, which could pertain to the fraud, be segregated and preserved.  This may require, but not be limited to, the performance of the following steps:
  1. Isolate and preserve the suspect employee’s computer: take the employee’s computer off the network and physically isolate it in a safe place (i.e. lock it up).  Include peripheral devices such as thumb-drives, recordable CDs/DVDs, tape drives, or company-owned cell phones, which may have been in the employee’s possession;
  2. Consider engaging a forensic technologist immediately: forensic technology is a specialized practice area wherein trained professionals utilize tools and skills to create a forensic image of all electronic data, which may be pertinent to the investigation of a fraud.  In this case, it would be essential to make a forensic image of the suspect employee’s hard drive as well as any network logs and files which may have been accessed by the suspect employee (i.e. work files, e-mail files, etc.).  In some situations, it may be best to obtain a forensic copy of the entire network drive;
  3. Make a copy of the general ledger immediately: in substantially all businesses today, accounting records are maintained electronically, whether using a package as simple as QuickBooks, or as sophisticated as SAP.  Before any changes are made to the accounting records, which may overwrite or alter accounting information related to the fraud, make a complete copy of the general ledger.  Depending upon the accounting software in place, this step may be as simple as making a backup of the accounting files, or may require the use of a forensic technologist.  The worst thing a company can do is to try to “fix” entries made by the suspect employee.  This could obliterate key evidence of the concealment steps taken by the alleged fraudster;
  4. Isolate and preserve all hard copy evidence: often a fraud is discovered because of an unexplainable invoice, check, or other document.  These items should be preserved to avoid loss or alteration from their original state.  Photocopies should not be substituted for originals in terms of evidence.  Keep the originals in “as-is” condition;

• Make a preliminary assessment of the magnitude of the damage: this will likely be a rough estimate, and the company will often discover additional fraud losses as time goes on, but making a preliminary assessment of magnitude can be critical in making decisions regarding the investment of time and resources into the investigation; 

• Meet with employees: often the best sources of information are the suspect employee’s fellow employees who may be able to identify unusual behaviors or patterns which further unravel the fraud scheme and magnitude of damages;

• Contact law enforcement: get on the record with law enforcement right away.  Don’t let more than 24 hours pass without making this contact and be prepared to provide law enforcement with a copy of your evidence.  Also, be prepared to see prosecution through to its end; the biggest mistake companies frequently make is believing that firing the employee is punishment enough.  Criminal prosecution achieves two purposes.  First, the fact that employees know the company has a zero tolerance policy on fraud, and will prosecute, is a significant disincentive to others committing fraud.  Also, termination alone simply allows the suspect employee to perpetrate the same crime on someone else in the future;

• Contact your insurance company: most business policies have at least some employee theft coverage.  Unfortunately, unless someone at the business previously made the decision to purchase increased coverage in this area, the company may only have the typical minimum coverage of $10,000 to $25,000, but recovery of any money in this area is better than the recovery of none.  Additionally, the insurance company may be helpful in funding some portion of the investigation.

When companies initially discover fraud within the organization, there generally follows a period of anger, frustration, and confusion brought on by the shock of such an unexpected discovery.  It is during this period of heightened emotion that some of the most critical mistakes occur, which result in the destruction of crucial evidence.  If there is any hope of financial recovery and prosecution of the suspect employee, the immediate preservation of evidence in the matter will make all the difference in the world.

---

 

Tim Tribe is a Certified Public Accountant, Certified in Financial Forensics, a Certified Fraud Examiner, and a Certified Internal Controls Auditor.  He has been in practice for more than 13 years and is a Partner at Epps Forensic Consulting PLLC,  a Scottsdale-based boutique firm specializing in litigation support, forensic accounting, financial investigations, fraud examinations, and forensic technology. For more information, please call (480) 595-0943 or visit www.eppscpa.com.