I Found Fraud
Top 10 action items when fraud is uncovered or suspected
The Acuity Forensics Top 10 Action Plan is meant to highlight some of the most important steps you can take when fraud is found or suspected. These action items are highlighted here to help you regain control of your organization, secure key evidence, and timely contact the professionals who can assist you through this process. You may find that for your organization, some steps are necessary and some are not. You may also find that you need to execute them in a different order than listed here.
1. Take a deep Breath
When insider fraud is discovered, emotions run high. You may be experiencing feelings of shock, embarrassment, anger, and frustration.Learn More
It is our goal to return your power to you.
You can handle this. It might not be figured out overnight, but with a structured plan of action, you can get to the bottom of it. The best thing you can do first is to simply take a moment to center yourself. Take a deep breath. You will find you will need to come back here, to Step 1, more often than not. But, that’s okay. Making decisions from a more centered and calm position will typically result in a more positive outcome.
2. Log all communications and events
Find a dedicated yellow legal pad or notebook. It sounds simple, but this tool will serve two purposes. The primary goal here is to start documenting important information such as when the suspect was hired, what their job duties were, what clues uncovered the potential fraud, previous interactions that may hold clues to the situation, and interviews or conversations with key people.Learn More
Our clients have communicated to us that this “log” serves another purpose: it puts them back in the driver’s seat and helps them feel more in control of the situation as information and events unfold.
3. Eliminate computer and facility access
Does your suspect have access to a computer, tablet, phone or
Remote access to your servers, email system or any other cloud-based system should be immediately disabled.
The same goes for physical access. Keys and/or key-cards should be collected and in some cases, locks may need to be changed.
The goal of securing electronic devices, disabling remote access, and removing physical access to your location is imperative in reducing the risk that key evidence related to your case cannot be altered or destroyed.
4. Secure a server backup and all electronic devices in a safe
Most companies’ servers are backed up daily; however, many of those backups are “written over” after only a few days or weeks. We suggest taking the server backup performed on the day the fraud was discovered (or even a day or two before) and securing it separately so that it is not written over.Learn More
The same goes for information stored on the cloud. All electronic data should be backed up and secured in a safe or locked server room.
The same is true for the electronic devices you collected from Step 3. Often, the computer used by the suspect is repurposed for another employee. While we understand your resources may be limited, we strongly suggest that all electronic devices used by the suspect also be secured in a locked server room or safe. Do not repurpose devices until you receive the all-clear from law enforcement or your forensic accountant/forensic computer specialists.
Again, the goal is to increase the probability that all pertinent evidence is secured and accessible during the investigation. You would be surprised by the evidence that can be found on an individual’s laptop computer or phone. We have discovered mountains of evidence kept locally on these devices that would have never been discovered had they been wiped clean and/or repurposed.
5. Secure key documents
Start collecting bank statements, canceled checks, financial statements, vendor invoices, deposit slips, receipts, payroll reports or any other documents that may be pertinent to the case.Learn More
For example, if the employee was an Accounts Payable Clerk and was responsible for paying your bills, and you noticed that she had written an unauthorized check to herself or one of her personal credit cards, it would be important to call your bank and collect the bank statements and
Take an inventory of the suspect’s desk and ensure the contents are also either untouched (e.g. if they are in a locked office
The goal here is to ensure the timely return of personal effects, retain evidence necessary for your case, and to ensure the continuity of your business by identifying documents necessary to transact day to day business.
6. Contact owners and management
Depending on the size or type of organization (e.g. non-profit), there may be inside individuals who need to be notified of the potential fraud.Learn More
As an example, there may be a board of directors to call, or perhaps you manage the business and need to call the owner and/or CEO.
It is important that any contact to insiders be limited to those individuals who need to know about the situation. Conversations should include the events that precipitated the uncovering of the fraud, actions taken to secure evidence, a plan on how best to interact with the
7. Contact legal counsel and insurance agent
When fraud is suspected or discovered, it is imperative that you understand your rights as an employer. It is also important to understand that the suspect has legal rights, too. This is where the good advice of an employment law attorney is a must-do.Learn More
We know that the cost of calling an employment law attorney might concern you. However, you may be surprised that paying for an hour or two of their time will get you the information you need to ensure your compliance with the law (and will be some of the best “insurance” your money can pay for!). Obtain referrals from trusted professionals in your local business community and take the time to call two or three to find the attorney who is a good fit for you.
Did you know you may have “Employee Dishonesty Insurance”? This insurance policy is typically a subset of your general business insurance policy and/or may be a stand-alone policy. In our experience, employee dishonesty insurance is the number-one way our clients find restitution for lost funds. Also, did you know that many of these policies will also pay for professional fees (e.g. lawyers and forensic accountants)? Call your insurance agent and inquire as to whether you have employee dishonesty insurance or a fidelity bond. Get an understanding of policy terms (e.g. total loss and/or per-occurrence language), benefits (e.g. payment of professional fees), and requirements (e.g. obtain a police report, deadlines for making a claim once theft is discovered, etc.).
8. Think about the end game
At the start of an engagement, our clients are often asking questions like, “Do we have to call the police?”, or, “Do I need to file a lawsuit against the suspect?” We always answer the same way: “Not yet. Allow yourself time to gain clarity around the situation and the appropriate end game will appear.”Learn More
You will find there are many options available to you. From do
These decisions can often feel overwhelming. However, they don’t have to be. Do not let emotions win the day (see Step 1). Instead, investigate the extent of what has happened in your organization and determine whether the length of the crime or the amount of the losses assist you in making decisions. Perhaps your organization has bylaws or other governing documents that help you make the decision? We recently worked a case where part of the governing board wanted to call the police and report the crime, while others wanted to spare the suspect the distress of going to jail, and admittedly, spare themselves the distress of sending someone they liked and trusted to jail. However, the by-laws of the organization were clear in instructing the board that a call to the local authorities was warranted in the situation. Relying on the governing documents assisted in making the decision a bit easier.
In most jurisdictions, there is a statute of limitations that allows for these crimes to be investigated prior to the suspect being charged. The same goes for an insurance claim. Know your options at the start, and then begin thinking about the potential end game. But remember, don’t feel pressured into making these critical decisions until you have as much information as possible about your case.
9. Consult with a forensic accountant
We know that incurring more expense when you’ve suffered losses can be hard to accept. However, consider consulting with a trained forensic accountant. A forensic accountant has specialized training in investigating fraud schemes, collecting evidence, conducting interviews, and putting your case together.Learn More
Working with the right forensic accountant means that you continue running your organization, while you leave the investigation of this situation in the hands of an independent professional.
Do you have limited funds? That’s okay! Find a forensic accountant who is willing to use some of your personnel resources to put a case together, coming in at the end to verify the work, write the report and help you navigate the process of reporting the case to your insurance company or local law enforcement. We once worked a large fraudulent disbursement scheme that required the review of thousands of
In a cash skimming case involving many years and daily analysis of incoming sales to deposits, we worked with the client’s wife and
There is no substitute for consulting with trained professionals in a time of need. And great professionals will work within your time and budget constraints to help you gain clarity in making appropriate decisions.
10. Mitigate risk going forward
We hope that you are well on your way to understanding the potential fraud scheme you’ve uncovered. But, you may be wondering, “How do I ensure this doesn’t happen to me again?”Learn More
We at Acuity Forensics are committed to providing organizations like yours with simple and effective processes and procedures to mitigate your risk of internal fraud. Most internal controls don’t require the hiring of more accountants or spending a lot of money. You can simply visit the “Preventing Fraud” section of this website to find information and tools to assist you in implementing appropriate internal controls for your organization. In the event that you are unsure you are implementing these controls appropriately, don’t hesitate to call your local CPA or work with a forensic accountant.