Top 10 Action Items When Fraud is Uncovered or Suspected
The Acuity Forensics Top 10 Action Plan is meant to highlight some of the most important steps you can take when fraud is found or suspected. These action items are highlighted here to help you regain control of your organization, secure key evidence, and timely contact the professionals who can assist you through this process. You may find that for your organization, some steps are necessary and some are not. You may also find that you need to execute them in a different order than listed here.
1. Take a deep breath
When insider fraud is discovered, emotions run high. You may be experiencing feelings of shock, embarrassment, anger, and frustration. Without notice, tears may suddenly emerge from your eyes. You've gone from being in a power position to feeling out of control. We want you to know that all of these feelings are normal. We've witnessed our own clients experiencing similar ranges of emotion. It is our goal to return your power to you.

You can handle this. It might not be figured out overnight, but with a structured plan of action, you can get to the bottom of it. The best thing you can do first is to simply take a moment to center yourself. Take a deep breath. You will find you will need to come back here, to Step 1, more often than not. But, that's okay. Making decisions from a more centered and calm position will typically result in a more positive outcome.

Watch the Video
2. Log all communications & events
Find a dedicated yellow legal pad or notebook. It sounds simple, but this tool will serve two purposes. The primary goal here is to start documenting important information such as when the suspect was hired, what their job duties were, what clues uncovered the potential fraud, previous interactions that may hold clues to the situation, and interviews or conversations with key people.

As emotions run high, we tend to forget important facts or details. This simple log will ensure there is a dedicated place to preserve information as you obtain it and/or remember it. This information will be key to forensic accountants, law enforcement, and others who may become involved in this investigation. Our clients have communicated to us that this "log" serves another purpose: it puts them back in the driver's seat and helps them feel more in control of the situation as information and events unfold.

Watch the Video
3. Eliminate access
Does your suspect have access to a computer, tablet, phone or other electronic device? Do they have the ability to access key documents and information stored "on the cloud"? All phones, computers, tablets, and electronic devices need to be collected and stored in a secured location. Remote access to your servers, email system or any other cloud-based system should be immediately disabled.

The same goes for physical access. Keys and/or key-cards should be collected and in some cases, locks may need to be changed. The goal of securing electronic devices, disabling remote access, and removing physical access to your location is imperative in reducing the risk that key evidence related to your case cannot be altered or destroyed.

Watch the Video
4. Secure backups & devices
Most companies' servers are backed up daily; however, many of those backups are "written over" after only a few days or weeks. We suggest taking the server backup performed on the day the fraud was discovered (or even a day or two before) and securing it separately so that it is not written over. The same goes for information stored on the cloud. All electronic data should be backed up and secured in a safe or locked server room.

The same is true for the electronic devices you collected from Step 3. Often, the computer used by the suspect is repurposed for another employee. While we understand your resources may be limited, we strongly suggest that all electronic devices used by the suspect also be secured in a locked server room or safe. Do not repurpose devices until you receive the all-clear from law enforcement or your forensic accountant/forensic computer specialists.

Again, the goal is to increase the probability that all pertinent evidence is secured and accessible during the investigation. You would be surprised by the evidence that can be found on an individual's laptop computer or phone. We have discovered mountains of evidence kept locally on these devices that would have never been discovered had they been wiped clean and/or repurposed.

Watch the Video
5. Secure key documents
Start collecting bank statements, canceled checks, financial statements, vendor invoices, deposit slips, receipts, payroll reports or any other documents that may be pertinent to the case. For example, if the employee was an Accounts Payable Clerk and was responsible for paying your bills, and you noticed that she had written an unauthorized check to herself or one of her personal credit cards, it would be important to call your bank and collect the bank statements and cancelled check images for the period of time your Accounts Payable Clerk worked for you.

Take an inventory of the suspect's desk and ensure the contents are also either untouched (e.g. if they are in a locked office); or are boxed and locked in a secure location. Typically, the personal items of the suspect (e.g. pictures, personal mementos, etc.) must be returned to the suspect timely. It is also a good idea to take pictures of the employee's desk just prior to the inventory. The goal here is to ensure the timely return of personal effects, retain evidence necessary for your case, and to ensure the continuity of your business by identifying documents necessary to transact day to day business.

Watch the Video
6. Contact owners & management
Depending on the size or type of organization (e.g. non-profit), there may be inside individuals who need to be notified of the potential fraud. As an example, there may be a board of directors to call, or perhaps you manage the business and need to call the owner and/or CEO.

It is important that any contact to insiders be limited to those individuals who need to know about the situation. Conversations should include the events that precipitated the uncovering of the fraud, actions taken to secure evidence, a plan on how best to interact with the suspect, if any, and evidence collected. Refer to operating agreements or bylaws, if applicable, to determine whether those documents oblige you to any specific decisions. If the contact is to a board of directors, the information may need to be conveyed in an Executive Session of a meeting.

Watch the Video
7. Contact legal counsel & insurance agent
When fraud is suspected or discovered, it is imperative that you understand your rights as an employer. It is also important to understand that the suspect has legal rights, too. This is where the good advice of an employment law attorney is a must-do.

We know that the cost of calling an employment law attorney might concern you. However, you may be surprised that paying for an hour or two of their time will get you the information you need to ensure your compliance with the law (and will be some of the best "insurance" your money can pay for!). Obtain referrals from trusted professionals in your local business community and take the time to call two or three to find the attorney who is a good fit for you.

Did you know you may have "Employee Dishonesty Insurance"? This insurance policy is typically a subset of your general business insurance policy and/or may be a stand-alone policy. In our experience, employee dishonesty insurance is the number-one way our clients find restitution for lost funds. Also, did you know that many of these policies will also pay for professional fees (e.g. lawyers and forensic accountants)? Call your insurance agent and inquire as to whether you have employee dishonesty insurance or a fidelity bond. Get an understanding of policy terms (e.g. total loss and/or per-occurrence language), benefits (e.g. payment of professional fees), and requirements (e.g. obtain a police report, deadlines for making a claim once theft is discovered, etc.).

Watch the Video
8. Think about the end game
At the start of an engagement, our clients are often asking questions like, "Do we have to call the police?", or, "Do I need to file a lawsuit against the suspect?" We always answer the same way: "Not yet. Allow yourself time to gain clarity around the situation and the appropriate end game will appear." You will find there are many options available to you. From do nothing, to terminating employment, to an insurance claim, criminal prosecution, or civil litigation.

These decisions can often feel overwhelming. However, they don't have to be. Do not let emotions win the day (see Step 1). Instead, investigate the extent of what has happened in your organization and determine whether the length of the crime or the amount of the losses assist you in making decisions. Perhaps your organization has by-laws or other governing documents that help you make the decision? We recently worked a case where part of the governing board wanted to call the police and report the crime, while others wanted to spare the suspect the distress of going to jail, and admittedly, spare themselves the distress of sending someone they liked and trusted to jail. However, the by-laws of the organization were clear in instructing the board that a call to the local authorities was warranted in the situation. Relying on the governing documents assisted in making the decision a bit easier.

In most jurisdictions, there is a statute of limitations that allows for these crimes to be investigated prior to the suspect being charged. The same goes for an insurance claim. Know your options at the start, and then begin thinking about the potential end game. But remember, don't feel pressured into making these critical decisions until you have as much information as possible about your case.

Watch the Video
9. Consult with a forensic accountant
We know that incurring more expense when you've suffered losses can be hard to accept. However, consider consulting with a trained forensic accountant. A forensic accountant has specialized training in investigating fraud schemes, collecting evidence, conducting interviews, and putting your case together. Working with the right forensic accountant means that you continue running your organization, while you leave the investigation of this situation in the hands of an independent professional.

Do you have limited funds? That's okay! Find a forensic accountant who is willing to use some of your personnel resources to put a case together, coming in at the end to verify the work, write the report and help you navigate the process of reporting the case to your insurance company or local law enforcement. We once worked a large fraudulent disbursement scheme that required the review of thousands of cancelled checks. Once we understood the potential patterns, the client hired a temporary employee at the fraction of our professional rates. We showed that person how to identify the pertinent checks, list them in a spreadsheet, and copy the fraudulent checks for the evidence binder. Once that work was completed, we came in and reviewed the checks and the spreadsheet, conducted interviews, and wrote the report.

In a cash skimming case involving many years and daily analysis of incoming sales to deposits, we worked with the client's wife and former controller to identify the documents necessary to prove that cash sales had never been deposited. In this case, they worked for several weeks copying the necessary documents and summarizing the data in a spreadsheet. We reviewed their work, created a marked evidence binder, and wrote a report that resulted in the suspect's arrest within a few days. The work of our client's wife and former controller saved them tens of thousands of dollars in professional fees and provided them the desired end result: the criminal prosecution of the suspect for losses nearing $500,000.

There is no substitute for consulting with trained professionals in a time of need. And great professionals will work within your time and budget constraints to help you gain clarity in making appropriate decisions.

Watch the Video
10. Mitigate risk going forward
We hope that you are well on your way to understanding the potential fraud scheme you've uncovered. But, you may be wondering, "How do I ensure this doesn't happen to me again?"

We at Acuity Forensics are committed to providing organizations like yours with simple and effective processes and procedures to mitigate your risk of internal fraud. Most internal controls don't require the hiring of more accountants or spending a lot of money. You can simply visit the "Preventing Fraud" section of this website to find information and tools to assist you in implementing appropriate internal controls for your organization. In the event that you are unsure you are implementing these controls appropriately, don't hesitate to call your local CPA or work with a forensic accountant.

Watch the Video
"Thank you very much for your help, Tiffany. Your attention to detail and persistence were exceptional!"
J.B.
Yakima, Washington
"Acuity's work for my law firm's' clients has always been very good -- highly professional, well presented, and thoughtfully completed. I appreciate Acuity's forensic accounting work very much."
J.M.
Vancouver, Washington