Internal and External Fraud Investigation

Fraud investigations begin with a discrepancy and a decision about how to react to it. Money is missing from an account, invoices do not match the work, a supplier turns out to be connected to an employee, a customer claims never to have received goods that were signed for. The way a company behaves in the next few days shapes everything that follows, because evidence is perishable and people act on what they sense.

The first hours, and why they matter most

The instinct to confront is usually wrong. Confronting a suspect, suspending a team, telling the finance department to look into it, or announcing a review all change the facts the investigation will later depend on. Emails are deleted, laptops are wiped, shared drives are reorganised and stories are aligned. The disciplined response is quieter and slower at the start: identify what could be evidence, secure it without altering it, and establish who has authority to direct the work.

Authority matters as much as evidence. An investigation needs a named owner, usually a board committee, a general counsel or an external adviser instructed by them, and a written scope. The scope will change as facts emerge, but it should exist from the first day, because an investigation without one drifts and loses credibility with the very audiences it will later face.

Internal and external fraud are different problems

Internal fraud is committed by someone inside the organisation, which gives them access, knowledge and the ability to conceal. It includes theft of cash or stock, false invoicing, expense manipulation, payroll fraud and the misuse of company assets. External fraud comes from outside: forged documents, payment diversion, supplier fraud, advance fee schemes and cyber-enabled deception. The two overlap, since an external fraud often needs an internal contact, and the investigation has to establish which it is before it can decide who to interview and what to preserve.

Forensic accounting, which reconstructs what happened

Financial records are the spine of most fraud cases. Forensic accounting examines them to reconstruct transactions, identify a pattern and quantify a loss. It is not the same as audit, which tests whether accounts are fairly stated. A forensic review starts from a question, such as where payments to a particular supplier went, and follows the money through ledgers, bank records, invoices and approvals. The point is to build a version of events that rests on documents rather than on a narrative, because documents are much harder to dispute.

Good forensic work also establishes the absence of explanations. If a payment has no legitimate business purpose that the records support, that absence is itself a finding, provided the review has looked for the purpose thoroughly enough to say so.

Securing evidence without changing it

Every item that may become evidence has to be handled so that its integrity can be demonstrated later. That means recording where it came from, who collected it and when, and keeping it unaltered from that moment. Digital material adds its own requirements: an email is best preserved with the data that shows its headers and its path, not as a screenshot, and a device is best imaged in a way that leaves the original untouched. The guide to cyber crime and digital evidence covers the chain of custody a court expects, and the guide to litigation support covers document control once a matter reaches a dispute.

Interviews, planned from the evidence

Interviews are conducted late, not early, and only when the evidence supports the questions. A witness interview seeks to establish what a person saw. An interview of a subject is more delicate, because it engages the person's rights and the rules on employment and on legal representation, which differ by country. What both have in common is planning. The interviewer works from the documents, puts questions fairly, avoids leading the person toward a conclusion, and records the account in a form that can be relied on. An interview conducted to confirm a theory rather than to test it damages the case it was meant to strengthen.

The order of interviews is a strategic choice. People who can corroborate each other are usually seen separately, and the sequence is decided by what the evidence already shows, not by seniority.

Tracing what was taken

Establishing the loss is only half the work. Recovery depends on finding where the money went. Fraud proceeds are moved quickly, often through several accounts and companies, and sometimes abroad. Tracing them draws on bank records obtained through the proper process, on company registers, on property records and on the filing of documents. The guide to asset tracing sets out the methods and, just as importantly, their limits.

The report, and the decisions it supports

A fraud investigation ends with a written report whose readers may include a board, a regulator, an insurer, an auditor and, if the matter is prosecuted, a court. It separates established facts from inferences, gives a source for each finding, records what could not be established, and states the assumptions behind any conclusion. It does not accuse beyond the evidence, and it does not soften a finding to protect a colleague. A report written to be read by the least friendly of its audiences is the one that holds up.

Prevention, which is the real purpose

Most frauds exploit a control that was absent, a segregation of duties that was never enforced or a warning that was not escalated. The final value of an investigation is not the recovery but the change it produces. In regulated firms that duty is written into the rules, which is why the findings of an investigation usually flow into the compliance programme rather than ending in a file.

Where to read about fraud patterns

The Association of Certified Fraud Examiners publishes research on how occupational fraud is committed and detected, drawn from cases reported by its members. It is a useful reference for the patterns an investigation is likely to encounter. The address is acfe.com.