When investigating workplace fraud, you have to be an island. That’s the advice that Stephen Pedneault, fraud expert, author and founder of Forensic Accounting Services, LLC, would give to someone conducting an internal investigation.

Listen to all points of view, he says, but think for yourself. “Getting everybody’s stories is important, but it’s not what you are going to base your end result on.”

Get the Full Story

Firstly, it’s critically important to interview the suspect, even if you already think you have the case solved. “If you don’t ask for their version of what happened, you didn’t do everything you could have possibly done,” he says. If the suspect refuses to comply or their counsel rejects the request, document that in your report as you can then say you’ve exhausted all means.

And there’s another good reason to interview the suspect: Sometimes, what they say is true. “I have had employees set up by their employers,” says Pedneault. “I have seen stuff where what I was told by counsel or by the victim is not what happened at all, and the person was being set up, or there’s another explanation for it. We would have ruined somebody’s life, and potentially put ourselves at risk for being sued,” he says.

Answer all the Questions

Secondly, do your homework. Being diligent, says Pedneault, includes answering the following four questions:

1. Is what I’m looking at some sort of fraud, crime or scheme?
2. Is this the only explanation for what I’m seeing?
3. Is this person responsible for these activities?
4. Is this the only person who could have been responsible for this?

“If I can answer these four questions in the affirmative and support it with exhibits and evidence, then I’m done. If not, I’m not done.” Without these answers, the case may remain unresolved, he says, because the risk of making a mistake is too great on a hunch.

Hands Off the Evidence!

And thirdly, preserve the evidence. One of the biggest investigation mistakes Pedneault comes across in his work is the failure to recognize and secure evidence. It’s critical to establish a chain of evidence to enable you to admit it in court, should the need arise.

This generally applies to computers used in fraud cases. People want to self-deputize as forensic accountants, he says. “The first thing they do is they get on the computer to figure out what (the suspect has) been doing. They look around to see what’s going on… And guess what they did? They have forever ruined the computer evidence.” Don’t make this mistake, Pedneault warns.

The first thing that must be done when there is a computer involved in the crime is to get a computer forensic person to clone the hard drive, says Pedneault. “Once the hard drive is cloned you can do whatever you want. Because now we can go back and say this is what it looked like on the day you called me.”

Then you look at the websites visited and the hard drive. “You get the forensic people to undelete the hard drive,” says Pedneault. “It always amazes me what you find on their hard drives, which goes well beyond financial… You never know a person until you undelete all the stuff on their hard drive they didn’t want you to see,” he says.

Be vigilant, advises Pedneault. “Be an island, stand on your own, be objective, ethical, unbiased, be an advocate for your work. Listen to all the other stuff but don’t become a tool used by a party or individual.” Not only is your reputation at stake, but somebody’s future may depend on it.