#Article

How to Conduct an Effective Fraud Investigation: The Complete Guide


Learn how to investigate a corporate fraud case, which can help protect your organization from reputation damage and financial losses.

What is a Fraud Investigation?

A fraud investigation is a systematic process of examining and uncovering instances of deceit, dishonesty, or unethical behavior that financially benefits the perpetrator. It involves gathering evidence, analyzing records, conducting interviews, and verifying information to determine whether fraudulent activities have occurred. The goal is to identify the perpetrator(s), assess the extent of the fraud, and take corrective or legal action to mitigate damage to the business. Fraud investigations are critical for protecting organizational integrity, assets, and reputation.

Don’t gamble with your company’s business fraud investigations.

Case IQ software is a better way to manage investigations. Case IQ is a specialized investigative case management tool to make your investigations more efficient and consistent. Request your demo to find out how users are saving time, closing more cases, reducing risk, and improving compliance.

Request a Demo

In December 2022, a former director of finance at New York University was accused of diverting $3.4 million in funds meant to help minority- and women-owned businesses.

The fraudster allegedly created two shell companies, which she is accused of using to divert the money for personal use, including major renovations to her home.

No matter what industry you work in or the size of your company, you’re at risk of fraud schemes from employees, clients, vendors, and others.

Fraud investigations aim to uncover what behaviours occurred, by whom, and how. If you conduct a poor investigation, you’re not only at risk of failing to recover losses. You could also face reputation damage, legal fees, fines, or non-compliance penalties.

How do you handle a fraud case? Use the fraud investigation steps in this guide to ensure your work is thorough, timely, accurate, and compliant.

6-step Process Chart of Fraud Investigation

1. Steps to Take Before Launching a Fraud Investigation

After you receive a fraud allegation or detect suspicious behavior, you have to decide if it’s worth investigating.

Before starting your investigation, consider the facts. Does it seem the report was made in good faith? Is there data to back up the allegation of fraud or theft?

A. Assess the Situation Thoroughly

The goal of a business fraud investigation is to uncover whether it occurred and if so, who committed it. Determine:

  • What law or policy was allegedly violated?
  • Were multiple people accused?
  • Do any of the suspects have a history of similar behavior?
  • Do any of the suspects exhibit red flags of fraud (e.g. living above their means, working unusual hours, etc.)?

B. Choose the Right Investigator

Next, decide if you will use an internal or external investigator.

An internal investigator is inexpensive and gives you control over the timing and scope of the investigation. An external investigator, on the other hand, offers an impartial and objective perspective on the situation, but may cost more than your organization can afford.

C. Conduct an Interview with the Reporter

If there is a whistleblower, interview the person who reported the fraud for context. If the fraud was discovered by an auditor, interview them.

Based on the information these witnesses share, determine whether you have a reasonable factual basis for an investigation. If you don’t, contact other sources (such as the accused person’s manager or cube mate) that could help provide more information. If there’s no one else to talk to or you still can’t reach the factual basis, an investigation may not be appropriate.

RELATED: Interviewing Tips for Corporate Fraud Investigations

D. Take Necessary Interim Actions

The key to reducing the damage caused by fraud is to stop it as soon as you detect it.

Change passwords and locks to prevent further theft of data or funds. If the alleged fraudster is a client or customer, suspend their system and/or building access during the investigation.

If you suspect an employee of fraud, consider temporarily suspending them with full pay until the investigation is complete. Clearly communicate to them that this is not a disciplinary measure and document the conversation. This step can protect you if the employee claims they were treated unfairly.

E. Review Company Policies and Protocols

Reread your company’s policies surrounding ethics and compliance, fraud, and other relevant topics. This can help you determine what law or policy the fraudster violated.

Then, prepare for the investigation by reviewing the organization’s fraud investigation procedures. Download document templates (e.g. investigation reportinvestigation plan) to get organized faster.

Ensure your fraud investigation process is thorough and consistent.

Download our free checklist to ensure you don’t forget any key fraud investigation steps.

Get the Checklist

2. How to Plan an Effective Fraud Investigation

If you want your business fraud investigation to be a success, you can’t go into it without a plan.

A plan gets your team all on the same page regarding the investigation’s goals, methods, and deadlines. Remember to be flexible, as your plan might change as the investigation progresses.

A. Define the Investigation's Scope

Identify exactly what you are trying to learn through the investigation. For example, what policy was allegedly violated and by whom?

Keep the investigation’s scope as narrow as possible to protect innocent people. Having a clearly-defined scope not only keeps your fraud investigation on track, but also ensures that it is fair and compliant.

Figure out which authorities or regulators you’ll need to report to (such as the Federal Trade Commission) if you determine fraud has occurred. This step helps you set a timeline and investigation strategy.

B. Develop a Clear Strategy

A clear strategy ensures you don’t miss any key information or duplicate efforts.

As you create your investigation plan, ask:

  • What do I already know?
  • What do I need to find out?
  • Who will I ask for information?
  • What documents do I need to review?
  • What methods will I use to prove or disprove the allegation?
  • Who needs to complete each task?
  • What is my timeline?
  • Who needs to know the fraud investigation’s outcome?

In other words, what do you need to do to investigate who did what actions, and in violation of what? When, where, and how did they do it? Who needs to complete what steps and by when?

C. Prepare an Interview List

Next, make a list of individuals who could offer insight into the suspected fraud.

Start with the reporter (if there was one) and the employee’s manager. The suspect’s colleagues, friends, and family may also be able to provide motive, background, and other information that corroborates or contradicts the allegation.

Experts such as forensic accountants and data scientists can help you figure out how the fraud was committed.

Interview the suspect last. That way, you can ask them about all the details that came up in the other interviews.

D. Set a Realistic Timeline

Finally, set deadlines for each stage of the fraud investigation process, including interviews, document retrieval, and reaching a conclusion. Assign tasks to members of your investigation team based on their strengths and knowledge.

Work fast to increase your chance of recovering losses and decrease the risk of losing evidence, but not so quick that you’re sloppy.

One tool to help you track, analyze, manage, and prevent workplace fraud.

Find out how case management software can help you improve your fraud investigation techniques in our free eBook.

Get the eBook

3. Tips for Conducting Effective Interviews During a Fraud Investigation

According to investigation expert Meric Bloch, “interviewing is usually the most important part of any investigation.” This is the stage when you gather the information you need to draw a conclusion from first-hand sources.

It’s a good idea to have a second investigator or an assistant in the interview to take notes, so that you can concentrate on the interviewee.

Many investigators record interviews, while some feel this can make the interviewee nervous. Before recording, check your state’s laws to see if you need the interviewee’s permission.

A. Begin with a Clear Explanation of Purpose

Begin each interview by explaining what will happen and what you expect of the interviewee. This allows you to stay in control while putting their mind at ease.

Explain that their answers will be kept confidential wherever possible. Assure them that they’ll be protected from retaliation, citing your organization’s anti-retaliation policy.

B. Use a Structured Interview Outline

While you may be tempted to use an interview script, opt for an outline instead.

Bloch emphasizes that the interviewee’s answers, not your questions, are the evidence, so your wording isn’t as important as the information you receive. Plus, an outline allows the conversation to flow more naturally than a rigid script.

C. Establish Rapport with Interviewees

Interviewees are more likely to open up to a friendly person. Start by making small talk, rather than diving right into the tough questions.

Make them feel comfortable and thank them at both the beginning and end of the interview. No matter what information they provide, keep a positive attitude.

D. Ask Questions with Precision

First, set a baseline with easy questions, such as “What is your position at [Company Name]?” or “How long have you known [Subject]?”

Ask open-ended questions to avoid leading the interviewee. For example, instead of “Did you see Kim shredding a vendor file?”, ask “What did you witness on July 15th?”.

Use clear, plain language, avoiding jargon or acronyms they might not know. Finally, make sure your questions are straightforward.

Rapport with an interviewee can make or break an interview.

Download our cheat sheet to learn tips for building and maintaining rapport.

Get the Cheat Sheet

4. Best Practices for Reviewing Records and Documents

In addition to gathering details through interviews, you must review records, documents, photos, videos, and other evidence. Records provide information that interviewees may forget or intentionally withhold.

A. Review Email Records

Looking through the accused person’s email history may reveal signs of fraud, such as large bank deposits or complaints about their finances.

Make sure your internal policies make it clear that you can access employee work emails at any time. If possible, get access to their personal emails, too.

If there is more than one suspect, read their correspondence with each other to find evidence of a fraud scheme.

B. Analyze Personnel Files

Next, review the suspect’s personnel file. Look for red flags including:

  • Weeks of unused leave
  • Logins to company accounts/networks at odd hours
  • Advances on their pay
  • Decline in performance

All of these could be indicators of fraudulent behavior. However, be careful to only present the facts of this evidence, not inferences or judgements, in your investigation report.

C. Only Review Relevant Documents

Documents provide a snapshot of the time they were created, especially emails and instant messages from Slack or Microsoft Teams. For this reason, reviewing documents outside the scope of your investigation could muddle it.

Sticking to relevant records keeps your team on track and reduces your liability should the alleged fraudster challenge your conclusion.

D. Retain Copies of Documents

As you investigate, keep copies of records on hand to review again. Retaining copies allows you to make notes on the documents without damaging the originals.

If you use a case management system, you can organize all of the investigation information, including interview notes, records, and other evidence, right in the case file.

5. How to Analyze and Validate Evidence

Now that you’ve gathered evidence, assess if you have enough information to draw a conclusion. Have you found enough facts to guide your organization’s decision-makers in correcting and preventing this problem?

In internal fraud investigations, you can’t afford to determine the case inconclusive. Not convinced? The Association of Certified Fraud Examiners (ACFE) estimates that organizations lose five per cent of their revenues to fraud each year.

A. Assess Evidence Quality

Analyze the evidence you’ve gathered. Bloch stresses that you should only use evidence for fraud investigations if it is:

  • concrete
  • specific
  • relevant to the investigation
  • competent
  • authentic

If a piece of evidence doesn’t meet those standards, don’t use it when drawing a conclusion.

B. Ensure Evidence Security

Confidentiality is key for any investigation, but especially important in fraud cases.

Lock up physical evidence. Protect digital information by encrypting files or using a secure case management platform with role-based access.

C. Distinguish Facts from Opinions

As an investigator, it’s your job to uncover facts based on evidence, not make judgements or assumptions.

When drawing a conclusion, use only objective facts, not inferences (what you assume based on a fact) or opinions (subjective beliefs you hold).

D. Check Evidence Against the Allegation

The goal of a fraud investigation is to prove or disprove each element of the allegation. Did the alleged behavior occur? Did the alleged fraudster do it? If you can’t achieve this with the evidence you’ve gathered, keep working until you can.

For instance, the allegation states that Bob stole money out of till number four on March 31. The work schedules you’ve reviewed prove Bob was working at till number four on March 31, and security footage shows Bob opening the till, removing funds, and slipping the cash into his pocket.

These pieces of evidence corroborate the allegation that money was stolen from till number four on March 31 and that it was Bob who took it.

Search engines are one of the best tools you can use to uncover evidence.

Solid online research skills can make your investigations more thorough and efficient. Watch this free webinar to learn helpful techniques and tools for gathering information you need online.

Watch the Webinar

6. Writing a Clear and Comprehensive Fraud Investigation Report

“A well-written report, because of its reliance on facts and not speculation, shows both that you have done your job and that you met your responsibilities to the company,” explains Bloch.

Your fraud investigation report should be simple, factual, and limited by the scope of your investigation.

An investigation report should include your investigative approach, facts and analysis of the evidence, a determination, and recommendations for corrective action.

However, avoid drawing legal conclusions; leave that up to the appropriate authorities instead. Just focus on whether an internal policy was violated.

A. Avoid Using Inflammatory Language

The final investigation report should present facts, not your opinions or judgements. To keep it objective, avoid using words like “allegedly” or “supposedly.”

Don’t use inflammatory or negative language. For example, say “During his interview, Bob looked around the room and avoided eye contact” rather than “Bob seemed nervous and shifty.”

In addition, never say that your determination is an outright fact. Instead, report that the investigation determined the elements of the allegation.

For instance, “The investigation determined that Bob created a fictitious vendor profile for XY Office Supplies. The investigation determined that Bob wrote a check for $2,000 to XY Office Supplies on August 4th. The investigation determined that Bob deposited a $2,000 check made out to XY Office Supplies into his bank account at World’s Best Bank on August 5th.”

B. Incorporate Direct Quotes from Interviews

In addition, include direct quotations where possible. You’ll be less likely to misconstrue an interviewee’s words and reduce your risk of a challenge to your determination.

Take thorough notes or record interviews (with consent) so you can include as many quotes as possible. If the accused person confesses or admits to fraud, report exactly what they said.

C. Minimize Industry Jargon

Limit your use of jargon, acronyms and technical terms. If you must use them, define each word or phrase the first time you use it in the report.

Your fraud investigation report should be able to stand on its own without supplementary documents or knowledge. If it doesn’t, simplify and edit until anyone could understand it.

You never know if your report might be read by someone who doesn’t know technical terms, such as a board member or external expert.

D. Reference Supporting Documents

Finally, describe the records you used as evidence and the facts that you found in each one. Include copies of written and visual records, plus links or information on where to find other forms of evidence you cited (such as video or audio clips).

Reference organizational policies and procedures that were violated by the fraudster as well. Attach each of these documents with key passages highlighted, too.

Frequently Asked Questions About Fraud Investigations

1. What is needed before starting a fraud investigation?

Before starting a fraud investigation, it's crucial to assess the situation by considering the facts, evaluating whether the report was made in good faith, and determining if there's sufficient data to back up the allegation of fraud or theft. If you do decide to investigate, create an investigation plan and assemble your team before you take any action.

2. What must you include in your fraud investigation?

In your fraud investigation, it's essential to include a thorough review of records, documents, emails, personnel files, and other relevant evidence, ensuring confidentiality, adherence to protocols, and separation of facts from opinions or assumptions. You'll also need to conduct interviews of the subject and witnesses and write a final report of your findings.

3. What is the methodology of fraud investigation?

The methodology of a fraud investigation involves a systematic approach, including deciding whether to investigate, assessing the situation, selecting an investigator, interviewing relevant parties, taking interim action to prevent further harm, planning the investigation, conducting strong interviews, analyzing evidence, writing a comprehensive investigation report, and implementing corrective actions based on findings.

4. What is the purpose of a fraud investigation?

The purpose of a fraud investigation is to uncover fraudulent activities, identify those responsible, and gather evidence to take appropriate corrective or legal actions. It also aims to assess the extent of the fraud, prevent recurrence, and protect the organization's assets and reputation.

5. When should a fraud investigation be initiated?

A fraud investigation should begin as soon as there are credible allegations or signs of fraudulent activity, such as discrepancies in financial records, reports of unethical behavior, or suspicious transactions. Prompt action helps preserve evidence and limit damage.

6. How do you ensure confidentiality during a fraud investigation?

Maintaining confidentiality is critical. Investigators should limit information access to those directly involved, conduct interviews discreetly, and secure sensitive documents and evidence to prevent leaks.

7. Why is documentation important in a fraud investigation?

Proper documentation ensures that all actions, findings, and evidence are recorded accurately. This creates a clear audit trail, supports accountability, and strengthens the organization’s position in legal proceedings or disciplinary actions.


How Case IQ Can Help Your Fraud Investigation Process

If you’re still simply reacting to fraud and theft, you’re putting your organization, your employees, and your reputation at risk.

With Case IQ’s powerful case management software you can increase oversight, track and manage fraud investigations, and report on results for better fraud risk management and prevention.

Case IQ’s award-winning reporting tool highlights trends and hot spots in investigation data, helping you identify your areas of risk. Use this insight to focus preventive measures and improve your program.

Learn more about how Case IQ can improve your organization’s fraud investigation techniques here.