Planning the Investigation 

Establishing the Scenario

The amount of information available during the earliest phase of an engagement will vary from case to case. Establishing what is known is of special importance. This is true because it has a direct impact on the nature and scope of the investigation.

A known or suspected fraud almost always comes to light through one of the following three broad scenarios:

1. Accounting irregularities. One of the most common irregularities is a discrepancy between the book value of an asset and its value as determined through physical counts or confirmations. For example, a physical inventory count may reveal a major shortage compared to the perpetual inventory records, or accounts receivable confirmations may reveal much lower values than the accounts receivable subledger. Other common examples include bank reconciliations that do not balance, and complaints from customers that their statements are incorrect. Any irregularity that comes to light during an internal or external examination would also fall into this category. The common theme in all of these examples is that the company's records—its information system—have raised a red flag that signals the possibility of fraud.
2. Immediate physical evidence. Physical evidence may be readily apparent or uncovered upon inspection. Obvious examples include the aftermath of sabotage or arson. Human or electronic surveillance techniques might also yield immediate evidence (for example, with respect to employee theft or the diversion of inventory).
3. After-the-fact incriminating information. Incriminating information is a grab-bag category that comes in various incarnations: outright confessions brought on by guilt, anonymous tips, memos in brown envelopes, whistle-blowing employees, irate spouses looking to get back at their fraud-perpetrating husband or wife, honest citizens just trying to do the right thing, and so on.

In any fraud investigation the first step is to establish which of these three scenarios exists, and the nature and scope of the related evidence.  

Identifying Areas of Concern and Uncertainty

The next step in the planning phase is a blending of the Boy Scout motto: be prepared and Murphy's Law: whatever can go wrong, will. Immediate areas of concern depend on the scenario identified in the previous step. Dealing with sabotage requires the immediate beefing up of security at other likely targets to prevent further damage. Dealing with a specific employee who is suspected of fraud—such as an accounts receivable clerk who might be perpetrating a lapping scheme, or a shipping department employee misappropriating inventory—you would want to secure all possible evidence and remove the suspect employee from the scene. Removing the employee from the scene need not be done in a direct, accusatory way. For example, if the fraud red flag is not common knowledge among the work force, the employee could be sent on a week's training course.

Beyond the immediate concerns of asset protection and evidence preservation, it's important, to the extent possible, to identify the uncertainties in the investigation—any pieces of the puzzle that are missing, so to speak. What are the major strengths and weaknesses of the existing evidence and supporting material? What additional evidence is likely to be available? What additional research, investigation and analysis are likely to be required to obtain any needed additional evidence and make it useful? Without at least a rough idea of where you're going, you most likely will not arrive at any valid conclusions.

Perhaps most important, you should think of any constraints, obstacles and pitfalls you are likely to encounter along the way. Obviously, forensic accountants and investigators need to be concerned about legal constraints in conducting their investigation. For example, as a general rule, only law enforcement authorities in possession of a valid search warrant can legally search a residence or a vehicle. (There are several exceptions, but for practical purposes none of them would apply to a fraud investigation.)

Less clear may be situations such as searching employee lockers. Judicial authorities have established that if employees have been put on notice all along that their lockers are subject to inspection, they probably can be searched. If this notice is lacking, legal counsel should be consulted, which should be the rule followed in all cases. Other concerns of investigators include lawsuits for false accusations or wrongful dismissal, and constraints imposed by collective bargaining agreements. The point is that a fraud investigation can be a legal minefield that must be navigated very carefully and deliberately, not haphazardly. To keep from hitting a mine, the safest course to set is early consultation with appropriate legal counsel and an experienced forensic CPA.

In addition to legal constraints, factors such as the company's reputation and relationship with its employees must be considered. For example, you would not want to alienate all your employees through hasty implementation of draconian investigative or security measures, just because of one bad apple.

Defining the Nature and Scope of the Investigation

The last step in the planning phase is to define the nature and scope of the investigation. This should be a fairly simple and straightforward process if the first two steps—establishing the scenario and identifying areas of concern and uncertainty—were properly thought out.

The nature and scope of the investigation are defined by several interrelated attributes including—

• The nature of the main objective—for example, prevention of further incidents, dismissal of the perpetrator, proving the case for criminal prosecution, establishing a loss claim, and so on—and the ranking of the objectives when there is more than one.

• If a criminal prosecution is envisaged, the point at which to involve the police.

• The level of secrecy or cover required in conducting the investigation. For example, if the scenario involves an anonymous but seemingly credible tip implicating a purchasing employee in a kickback scheme, the objective may be to prove the case for criminal prosecution. The nature of the investigation will be fairly secret, because the parties involved are unlikely to confess and you would not want to alert them to the investigation. Because kickback (that is, secret commission) cases can be difficult to establish, the scope of the investigation could become extensive, including background investigations of both the bribe giver and bribe taker, surveillance, and possibly even setting up a sting operation.