Fraud and Investigations

A corporate investigation starts when a suspicion becomes something that has to be answered. Money is missing, a contract was won on information that should not have existed, an employee has been approached by a competitor, a payment went somewhere no one can explain. The work that follows has one purpose: to establish what happened, in a form that will survive being challenged, whether by a court, a regulator, an insurer or an employment tribunal.

Why the first hours decide the case

The value of an investigation is often fixed in its first days, before anyone knows the size of the problem. Evidence is perishable. System logs roll over, emails are deleted, a laptop is reimaged, a person leaves and takes a phone with them. A company that reacts by confronting a suspect, suspending a whole team or announcing a review has already changed the facts it will later need. The disciplines of an investigation exist to prevent that: identify what might be evidence, secure it without altering it, and only then start asking what it means.

This is why an investigation is usually opened quietly and run under a defined authority. Someone has to own the decision, usually a board committee, a general counsel or an external adviser instructed by them. The scope is written down early, even when it is expected to change, because an investigation without a written scope drifts into fishing and loses its credibility.

The three families of corporate investigation

Most corporate investigations fall into three broad families. Fraud investigations deal with money taken by deception, from inside the company or from outside it. They rely on forensic accounting, on the reconstruction of transactions, and on records that the person taking the money did not control. The guide to internal and external fraud investigation follows the sequence from the first alert to the written report.

Asset tracing investigations follow money that has already gone. Their question is not only who took it but where it now sits, in which bank, behind which company, under whose name. The guide to asset tracing sets out the public registers, corporate filings and court orders that make recovery possible, and the limits of each.

Litigation support investigations prepare a case for someone else to argue. They collect and number documents, build chronologies, preserve the integrity of exhibits and turn a mass of facts into something a judge or a jury can follow. The guide to litigation support and the evidence file covers document control and court presentation.

Evidence, and the difference between information and proof

Information becomes evidence when its origin, its handling and its meaning can be demonstrated. A screenshot of a chat is information. The same chat, exported from the system that hosted it, with a record of who exported it and when, and kept unaltered since, is evidence. Every step that touches a document, a device or a database leaves a trace, and the point of a chain of custody is to make that trace complete enough that no one can argue the item was changed. The guide to cyber crime and digital evidence explains how devices and logs are identified, preserved and handed over.

Interviews, which are not conversations

An interview in an investigation is a structured exercise with a purpose and a record. It may be a witness interview, which seeks to establish what a person saw, or an interview of a subject, which is conducted under rules that protect the person being questioned and the case itself. What matters is that the interview is planned from the evidence, that questions are put fairly, and that the account is captured in a way that can be relied on later. An interview conducted to confirm a conclusion rather than to test it is worse than no interview at all.

The report, and the decisions it supports

An investigation ends with a document, and that document has to be honest about its own limits. A good report separates established facts from inferences, names the evidence for each finding, records what could not be established, and states the assumptions on which any conclusion rests. It does not accuse beyond the evidence and it does not soften a finding to spare a person. Its readers are not only the client: it may be read by a regulator, a court, an auditor or an insurer, and it should be written for the least friendly of them.

When an investigation becomes a compliance matter

Many investigations end not in a courtroom but in a change of process. The facts that allowed a loss are usually a control that was absent, a rule that was not enforced or a warning that was not escalated. That is why the third section of this magazine, on compliance and regulation, sits beside the investigative work: the point of finding out how something happened is to make it harder to happen again, and in regulated firms that duty is written into the rules themselves.

The guides in this section

The section covers fraud investigation, asset tracing and litigation support and the evidence file, each read from the first step to the last.