Suppose you suspect an employee has committed fraud against your company. What do you do? Fire him/her on the spot? Probably not, since that could make the situation much worse, especially if you’re wrong. You also don’t want to tip your hand, because that could prompt your suspect to destroy evidence linking him/her to the crime. So, what do you do?

At this point, there are some important things to consider. First, is there sufficient predication (establishing if there is sufficient proof) to even begin an investigation. Then, depending on the nature of the case, determining who to inform such as your attorney, law enforcement, or reaching out to a firm that specializes in investigations that can help you decide on a plan of action. If the issue is adequately supported and once you have a general lay of the land, it is time to assemble an investigative team or engage a firm that specializes in investigations, perhaps under your attorney’s guidance.

While establishing predication, doing your initial planning, and assembling the investigative team, you should take all necessary steps to preserve evidence you come across. We encourage you to leave the fact finding to the professionals however also recognize that the suspicion has already been brought to your attention and with it perhaps evidence. How do you handle this information?

Save The Paper Trail

Whatever hard copies you have of documents linked to the allegation must go under lock and key, with minimal (preferably no) handling. Don’t make any notes directly on the documents. Instead, create an index of documents with a description of its relevance to the case. Be sure also to note how and where you found each document and the steps you took to preserve them.

The investigative team can then evaluate the evidence and determine how it fits into the case. Remember, if you can’t show a “chain of custody,” meaning where the documents came from and how they’ve been kept in your possession, a judge might suspect tampering and exclude the documents as evidence in any trial.

Approach the handling of documents with due care. Make any copies you need to continue operations but turn the originals over to your fraud investigator.

The Trouble With Technology

There are challenges to preserving digital evidence, especially if your IT staff hasn’t been trained to spot fraud and react to it. Suppose you wanted to examine an employee’s work computer to see if there’s evidence of fraud. You take possession of the device, and learn that your IT department recently serviced it, and had to wipe it clean to restore its capabilities. All the evidence you needed has been either been altered or destroyed.

To prevent such mishaps, your company should train your IT team on how to respond to fraud incidents. A fraud specialist would instruct them to immediately end any practice that causes data destruction whenever there’s a sign of fraud. If your computer system deletes certain information from time to time, such as emails, you should be able to halt that process as soon as you have any suspicion. If no member of your IT team is knowledgeable of computer forensics, call in an expert to assist as soon as possible.

The good news is that when an employee deliberately deletes, alters or corrupts files to cover his tracks, a forensic expert can often identify and restore those files. Experts can also access many password-protected files and discover if anyone has gained unauthorized access to any part of your system.

Forewarned is Forearmed

When faced with a suspicion of fraud, it is important to follow the rules and do things the right way or you could find yourself and your organization in hot water. While determining your next steps one of the most important steps you can take is to limit access to possible fraud evidence.