Business Management zone

When fraud strikes

It's the umpteenth time you've checked the figures and even allowing for 'spread-sheet sprain' you know it has all gone wrong: someone, probably an employee, has been ripping off the company. In the early days this might be all the information you have, even if you've got a suspect in your sights, but what on earth do you do next?

Most people react in one of three ways – all of which are wrong.

Keep your counsel

There will be a strong urge to tell other people, either to sound out your suspicions or to share the responsibility for sorting out the problem. It is best to keep quiet and only tell other people on a 'need-to-know' basis. Most frauds, especially serious ones, are committed by people in a position of trust and you might unwittingly tip-off the fraudster, or an accomplice and lose the advantage of surprise.

Fraud is headline gossip and the story will be the talk of the corridors if you're not careful who you tell and, equally importantly, how you tell them. Remember too that many people may have access to your emails.

Avoid confrontation

Fight or flight are the two human reactions to danger. Do not confront the person you suspect of committing fraud, it might satisfy your anger but you will only get a denial, swiftly followed by the rapid destruction of any evidence as the suspect covers their tracks. They are likely to talk to potential witnesses to encourage them to back up their story and any cash will swiftly disappear.

Don't become an ostrich

Running away from your suspicions won't help either. Fraud is often ignored because it is messy, there's often bad publicity, trades union involvement regarding the employees concerned, difficult conversations with regulators and worried shareholders, all on top of an already packed work schedule. In short, fraud is seen as too difficult a problem to deal with. However, the problem will only get bigger and lead to even bigger difficulties the longer it is ignored.

How to repsond

Refer to your 'Fraud Response Plan'. It is something to put in place and now may be a good time to do it. The incidence of fraud often rises when employees are feeling the pinch at home, and there is increased pressure at work to put in a good performance. Once a fraud has been discovered it is the wrong time to start thinking about your next steps.

The first thing to establish is who is going to lead the investigation internally on the part of the company. Will the board delegate authority to a specific individual to lead the investigation or does it need to be informed and what happens if one of them might be involved?

Knowing at what point it becomes necessary to refer the fraud upwards, depending on the level at which the fraud has been discovered and its potential size, is crucial. This is particularly relevant for regional or national subsidiaries and find out who will need to sign-off on any investigation.

The company has to decide on a person to lead the investigation internally and make sure they have the necessary knowledge and skills to undertake it. Often this skill is missing. So, who will need to be called upon to investigate?

Regular audit and legal recourse may not be suitable

It may not be appropriate to ask the internal audit department or the external auditors as they may have a conflict of interest. Find a firm that can cover all the angles, including industry expertise and geographical coverage, especially if the investigation is likely to extend beyond the UK.

It is also worth remembering that the company's legal advisors may be experts in arbitration or commercial property, but not in fraud-related issues. Do you have the right legal advice in place and does that legal advice extend abroad (if investigation covers foreign subsidiaries).

It's a good idea to keep individuals' contact details close to hand as invariably fraud is discovered at an inconvenient time, such as 7pm on a Friday evening before a bank holiday weekend. Having the head of human resources or the head of IT if an employee's computer access needs to be reviewed or eventually removed, contacts to hand is advisable.

Once you have established your team, bring them together and establish the objectives of the investigation which could be to simply remove the employee, take civil action to recover the assets or initiate criminal proceedings.

Once the team has a fairly good idea of the issue they can decide who else needs to be kept informed. If the regulator(s) need to be informed, it is better to contact them as soon as possible. Telling them early will make them feel everything is under control. If the company is insured it may need to inform the insurer up-front in order to get cover for investigation costs and legal fees. If the company has shareholders, or other stakeholders, will an official announcement to the market be necessary? Handling communications with these bodies in a confident and competent way will buy time and grace in which to act.

For investigations of foreign subsidiaries you might need visas and having all this pre-prepared will speed up the investigation. Speed is key in the immediate aftermath of a fraud being discovered. The goal is to act quickly in order to catch the fraudster and hopefully the money he or she has stolen, without having to think.

Create a plan for the first few hours, days and weeks of the investigation. If you need to confront the suspect – either to interview, suspend or sack - plan it chronologically. Will you need a court order to get access to his or her home to search for relevant information, or to freeze assets? If you want to suspend or sack the employee, do you have somebody lined up to step into their shoes in the interim to maintain business continuity? If the suspected fraudster is a bank signatory, who will contact the bank? Prepare a statement to explain the company's actions to staff (it's much better to let them know what's going on than to let rumour and speculation take over).

A statement should also be prepared for the press either as part of an agreed communications strategy for informing the media or in response to a leak by an employee.

Have the right people in place for D-Day, such as lawyers, IT staff, HR professionals, trades union representatives and trained interviewers if appropriate. Who's going to speak to the employee and/or other employees who might be witnesses? What are you going to say? It's wise to go into this situation with almost a prepared script. If you go into a meeting unprepared you risk being carried away by anger and frustration and saying things like: 'Get out! You're sacked!' That could result in a claim for wrongful dismissal. Stick to company policy and employment law. If the fraud was brought to light by a whistleblower the team will need to consider any actions regarding how this witness should be treated.

It is vital that when a fraud comes to light the first reaction is not panic. Speed of action and control are required for an effective investigation and recovery of funds. A pre-prepared 'Fraud Response Plan' is one way to ensure that when fraud happens, you control it rather than the other way around.

Andrew Durant is a managing director in Navigant Consulting's London office. The company is an international consulting firm assisting companies and their legal counsel in enhancing stakeholder value, improving operations and addressing conflict, performance and risk related challenges.


Number of comments: 1

Peter Henry, 25 June 2008 @ 14:19 PM

Why on earth would you not involve the Internal Audit dept. Fraud will be part of their remit and they will probably have at least one qualified fraud investigator on board.

What possible conflict of interest would they have - if they are involved then your problems are much bigger than just one member of staff.