Fraud: the client's perspective

We’ve all been there.
It is Friday afternoon and you are just beginning to wind down for the weekend when the phone rings. It’s a client with an urgent request for advice. In this instance it may be slightly different from the norm, however. They think that they have discovered a fraud within their company. What should they do?

This is a situation with which forensic accountants are all too familiar. However, as more clients – particularly those in business – are finding themselves the victims of internal fraud, it is increasingly a question which is being asked of their solicitors. So what should your client do?

Things to avoid

The initial steps which are taken at this point are crucial as they can have enormous implications for any subsequent action which your client may wish to take. Accordingly, it is well to establish at the outset your client’s key objective. It is likely that this will be centred on the containment of loss and/or the maximisation of recovery prospects. It will also be prudent at this stage to consider the possibility of police referral. For each of these considerations, the manner in which evidence is handled and preserved will be critical for success, and in view of the fact that getting things wrong can be a dangerous and irredeemable start, it is best to look first at those things which your client should be well advised not to do.

    Do not interview or confront a suspect without considering all possible alternatives, and do not suspend a suspect without understanding the facts. That may sound obvious, but there is often a tendency to take a knee-jerk reaction when there are suspicions of fraud, this being coupled with a quite understandable desire to get the individual concerned off the premises as quickly as possible. Take time to collect and assess the facts, refer to the company’s disciplinary procedures and take appropriate advice from HR and employment law specialists.

•     When reviewing the evidence, do not dismiss suspicions out of hand. This may seem slightly contradictory to the above but, in my experience, if something doesn’t feel quite right it probably isn’t, and if you find yourself thinking “There’s more to this than meets the eye”, then there probably is.
•     Do not rummage through a suspect’s office. Evidence requires to be systematically identified and preserved – “bagged and tagged” if necessary – recording precisely where and when it was found.
•     Do not tamper with documentation, and avoid the over-handling of documents. Without wanting to give the appearance of having watched far too many police dramas, you should bear in mind that it may be necessary to carry out forensic testing at a later stage. This could include handwriting analysis, fingerprinting or DNA testing. It is always preferable to seal pertinent documents in plastic wallets at the earliest possible opportunity. Even relatively minor “housekeeping” actions such as the stapling of similar documents together for safe keeping should be avoided as, just occasionally, it can be crucial to know whether documents were originally attached to each other.
•     Do not search a suspect’s computer. This really cannot be overstated. The simple act of switching on a computer can result in the loss of crucial data. Where it is considered that a suspect’s computer may hold valuable information, the computer should be secured and forensic computer specialists engaged to “image” the hard drive. As the term would suggest, this involves the taking of a complete copy of all the data held on the computer, which can then be systematically analysed without disturbing the original data.  

The better course

Having outlined what the client should not do, the following are steps which the client should consider:

•     Withdraw physical and electronic access rights and cancel any financial authorities (with the caveat that by so doing you would not be inappropriately alerting the suspect or “tipping off”).
•     Engage specialist professional services – this might include, for example, the services of an experienced investigator or forensic accountant.
•     Secure all assets and potential evidence from the danger of interference or contamination.
• Inform the insurance company. Even where initially the sum might appear quite minor it is invariably best to play safe. Often what appears on the face of it to be a small-scale problem transpires, after investigation, to be something much more substantial. If your client ends up submitting a large insurance claim, the insurers will want to know why they were not notified at the earliest opportunity.
•     Establish a communication strategy – consider employees, shareholders and whether there is likely to be media interest.
•     Consider whether to report the matter to the police. Increasingly clients tend to be more focused on recovery of losses, but there is no reason why, through effective liaison with the police, the two cannot go hand in hand.
•     Ensure that notes are retained of all discussions and meetings.
•     Where it is suspected that evidence is stored on a PC or laptop, forensic specialists should be employed to image the hard drive. Forensic technology specialists will then be able to interrogate the data including the recovery of deleted and damaged files, word searches on all contents, examination of email communications, and accessing password protected and encrypted documents.

Main objectives

As no two fraud cases are ever the same, the actual manner in which the investigation will proceed cannot be prescribed. However, the investigator – often a forensic accountant – will generally have two primary objectives: establishing proof of the fraud and tracing the suspect’s assets.

The analysis of accounting and banking information, together with investigative interviews, will often form the main part of the investigation. Ideally this will establish proof of the offence sufficient to proceed with disciplinary (and possibly criminal) proceedings. Complementing that objective, the plotting of assets will form the basis on which you, the solicitor, will proceed to freeze assets, request disclosure of information and, ultimately, seek recovery.

Two further aspects of the investigation process require to be addressed in more detail:

•     At some point in the investigation you will generally have to consider formally interviewing the suspect and, as in all aspects of the investigatory process, the manner in which such interviews are undertaken will be critical to success.
•     Increasingly, investigations rely on the use of technology – not only to analyse large and complex volumes of data but also, more importantly, to present evidence in a court-friendly manner.

In future articles we will look at the use of technology and the most effective ways of running the investigative interview process.

    David Buchanan-Cook is fraud investigation manager in the forensic department of the Edinburgh office of global accounting firm KPMG. The unit undertakes a wide range of fraud investigations and fraud risk management consultancy, and carries out expert witness and regulatory work. David is also a reporter with the Law Society of Scotland’s Client Relations Office and sits on one of the Client Relations Committees.