Fraud Investigation: The First Steps in Corporate Fraud

Mainstream

Responding to corporate fraud is not just an internal investigation. It is a strategy to protect business, assets and reputation.

The question is not who is to blame, nor even how it happened. The main question is how to stop the loss now and return the stolen.

An effective investigation after identifying signs of fraud begins with three immediate checks:

1. Is the illegal activity continuing right now?
2. Where is the evidence and how to protect it from destruction?
3. Where are assets that can be seized or frozen?

If these three issues are not resolved in the first hours, the company risks not only financial damage, but also lost evidence, withdrawn assets and material unsuitable for law enforcement officers.

When an emergency response is needed

A special fraud investigation procedure is required if the company is faced with:

• theft of funds by top management or employees;
• Withdrawal of assets through shell companies;
• falsification of financial and accounting statements;
• Kickbacks from counterparties;
• Procurement fraud (procurement fraud);
• corruption payments to public servants;
• unlawful use of confidential information;
• collusion of employees with external partners;
• financial fraud in subsidiaries or joint ventures;
• fraud detected during compliance checks or through whistleblowers.

The mistake most companies make

Many companies, when they find signs of fraud, start with an emotional question: “Who did this?” or “How can I punish him?”

That's the wrong first step.

The right question is: What do you need to do right now to preserve assets and evidence?

Sometimes the best result is immediate blocking of accounts and physical preservation of documents. Sometimes – an unofficial audit of IT systems until a sufficient evidence base is collected. Sometimes, you can immediately go to court for freezing orders. Sometimes it is a legendary audit under the guise of a planned audit.

Investigating corporate fraud requires not a standard procedure, but a lightning-fast defense strategy.

Step 1. Stop losses and secure evidence

The first thing to do is not to call the suspect or call a meeting. We need to stop the leak immediately.

Key actions at this stage:

• Isolate the suspect from IT systems, bank accounts and documents;
• Block corporate passes, remote accesses and accounts;
• Ensure the physical safety of servers, hard disks and paper archives;
• remove “forensic images” from laptops and mobile devices of key defendants;
• cease all questionable payments and approvals;
• to establish control over the mailboxes of suspected persons;
• To save video surveillance data and access control logs.

If evidence is destroyed in the first day, it will be extremely difficult to build a legally strong position, even if the fact of fraud is obvious.

Step 2. Ensure confidentiality and privilege

It is critical for international business that the results of an investigation be protected by legal privilege, otherwise the materials may be claimed by adversaries in future civil or criminal proceedings.

The structure of the work should be built through external legal advisers:

• the lawyer instructs the IT-forensics and audit;
• All reports are prepared for the purposes of legal analysis (protected by litigation or legal advice privilege);
• internal communications are dosed in such a way as not to create unwanted written evidence.

The mistake of this stage is to conduct an investigation exclusively by the internal security service and HR without legal supervision, which deprives the results of confidential status.

Step 3. Collect and record evidence

For a legal perspective, it is not assumptions that matter, but documents.

You must immediately unload and save:

• bank statements and payment orders;
• contracts with contractors that cause suspicion;
• Acts, invoices and consignment notes;
• correspondence (e-mail, messengers, internal chats);
• job descriptions and matrices of approvals;
• Corporate approval protocols;
• data from CRM and ERP systems;
• logs of access to premises and information systems;
• telephone records (if permitted in the jurisdiction);
• Declarations of conflict of interest.

Of particular value are documents where suspects discuss their actions, justify transactions or try to “legend” withdrawal of funds for fictitious services.

Step 4. Identify applicable law and jurisdictional risks

Corporate fraud is rarely localized. It often affects several jurisdictions: place of incorporation of the holding, country of activity of the "daughter", banks-recipients of funds, offshore transit zones.

Applicable law answers the questions:

• what is considered fraud and theft in a particular jurisdiction;
• What is the statute of limitations for filing a criminal application and civil action;
• Is it possible to confiscate assets in rem?
• whether data is admissible in court;
• Is it necessary to report suspicions to government agencies (mandatory reporting);
• whether there is a risk of breach of bank secrecy or data protection laws when collecting evidence.

If the applicable law is not determined at the start, the company risks gathering evidence that will not be usable or inadvertently violating local regulations.

Step 5. Select a strategy: criminal prosecution, arbitration or commercial settlement

Criminal prosecution

Filing an application to law enforcement agencies is effective if:

• The jurisdiction has a functioning mechanism for investigating economic crimes.
• The company needs a public demonstration of “zero tolerance”
• Assets can be arrested criminally faster than in civil cases.
• This is a major theft with an obvious crime.

However, transferring the case to the state means losing control of the process and reputational risks associated with publicity.

International arbitration or civil court

A lawsuit strategy is effective if:

• There is a convincing evidence base;
• return of assets in a civil case (for example, fraudulent transferance, conspiracy);
• Global freezing orders (worldwide freezing orders)
• Defendants are managers or counterparties with assets in different jurisdictions.

Commercial settlement

Sometimes the best commercial outcome is not a prison sentence, but restitution and dismissal. This requires tough negotiations with the suspect based on the evidence gathered, with a proposal to leave without scandal in exchange for a return of assets.

Step 6. Find and freeze assets (Asset Tracing and Emergency Relief)

A key step that should start at the same time as the investigation.

Before the suspect realizes that it is solved, it is necessary to identify:

• Bank accounts into which the funds were spent;
• chains of shell companies;
• Real estate acquired with stolen money;
• movable property (cars, yachts, luxury goods);
• cryptocurrency wallets;
• Shares in real businesses recorded on relatives.

In parallel, a request for emergency interim measures is being prepared:

• Global asset seizure (worldwide freezing order)
• A Norwich Pharmacal/Bankers Trust Order
• prohibition of alienation of specific property;
• Arrest of accounts for security purposes.

Winning a dispute and getting a decision against an empty debtor is a commercial failure. The purpose of a fraud investigation is to get back the money, not just to prepare a beautiful dossier.

Step 7. Conduct deep IT forensics and e-Discovery

Once the data is saved (Step 1), the professional analysis stage begins.

The process includes:

• Recovery of deleted files and correspondence;
• analysis of USB connection logs and actions with confidential information on the eve of dismissal;
• Identification of abnormal patterns in accounting systems;
• search for connections between employees and problem counterparties (social networks, messengers, metadata analysis);
• Identification of atypical logins into the system outside working hours.

The result of the forensic is not just a summary, but procedurally admissible evidence ready for transfer to court.

Step 8. Conduct an interview (in the right sequence)

Interviewing employees is one of the riskiest stages. Incorrect sequences can trigger evidence destruction or coordinated legends.

Classic tactics:

1. First, informed persons who are not suspects (ordinary performers, related departments) are interviewed.
2. Then there are secondary defendants who can be offered immunity from harassment by the company in exchange for testimony.
3. Last but not least, with the most evidence on hand, are the key suspects.

Interviews should only be conducted in the presence of a lawyer, with proper protocols (reminder of company policies, record of testimony, warning of the right not to incriminate yourself if local law requires it).

Step 9. Assess the risk to the company and prepare a communication plan

Fraud may result in:

• liability of the company for the actions of employees (corruption, violation of sanctions);
• Self-reporting before regulators;
• audit by tax authorities (fictitious expenses);
• reputational damage in the media and among investors;
• Defaults under credit agreements (covenants breach);
• civil suits of shareholders.

Before communicating information externally, it is necessary to prepare key messages, identify speakers and minimize the risks of secondary liability.

Step 10. Implement a damages plan and reform the system

Enforcement of decisions on fraud cases is a separate complex project, including:

• recognition and enforcement of foreign judicial acts in the countries where the assets are located;
• work with private bailiffs and local lawyers;
• parallel criminal and civil proceedings;
• restitution in the framework of transactions with investigation;
• insurance payments (if you have a D&O, crime insurance or fidelity insurance policy);
• System changes to internal controls (SOX, COSO) so that the circuit does not repeat itself.

In practice, without a properly conducted investigation early on, the money-back stage is often the most fruitless. It is the actions in the first 72 hours that determine whether a legal victory will turn into a real reparation.

Comparison of strategies: criminal prosecution vs. settlement

The choice depends not on the emotional desire to “punish”, but on the specific location of assets, the reputational strategy of the holding and the jurisdiction.

How to reduce risks before an incident occurs

The best response to fraud is prevention and preparedness.

It is advisable to build a system of "protected perimeter":

• A hotline for whistleblowers with an anonymity guarantee
• mandatory anti-corruption clause in contracts with the right of audit;
• Regular forensic screening of counterparties;
• Rotation of personnel in procurement and treasury;
• Automatic monitoring of transactions (red flags);
• mandatory coordination of conflict of interest;
• retention of data policy for logs;
• Pre-prepared emergency response plan (Fraud Response Plan)
• D&O and crime insurance policies.

The protocol should not be written for a report, but for a real crisis at three o'clock in the morning.

Common errors in the early stages of Fraud Investigation

1. Give the suspect the opportunity to destroy evidence. Slowness with IT-blocking allows you to delete files and warn accomplices.
2. Start by questioning the main defendant. Without a database of evidence, it reveals all the maps and ruins the investigation.
3. The promise to “get everything back” without immediately transferring assets is almost always a drag on time.
4. Mix internal investigation and PR activity. Premature press release or notification of the entire board of directors can lead to defamation claims and destruction of evidence.
5. Ignore the risk of privacy breach. Unauthorized access to an employee’s personal correspondence may make evidence inadmissible in European courts.
6. Do not think about returning assets until the investigation is over. If you don't freeze the accounts right away, they'll be empty by the end of the investigation.
7. Conduct an investigation without an outside lawyer. Violation of privilege makes internal reports vulnerable to recourse in common law courts.

Checklist for the Board of Directors and CEO

Before launching public procedures, 15 questions must be answered:

1. Are current losses completely stopped?
2. Are the suspects’ IT systems and documents isolated?
3. Is an external legal adviser appointed to protect the privilege?
4. Have forensic images been taken from devices?
5. Which jurisdictions are affected by the scheme?
6. Do we have any idea where the stolen assets are?
7. Can I get an emergency court order to seize assets?
8. Is there an obligation to notify the regulator (bank, exchange)?
9. Who will conduct the interview and in what order?
10. Is the data of whistleblowers protected?
11. How will the incident affect reporting and auditing?
12. Is there a risk of loan withdrawal?
13. What is the communication plan with shareholders?
14. Is insurance applicable?
15. What is the maximum return on money: Criminal or commercial?

What a strong first step strategy looks like

A strong strategy is usually built into five parallel tracks:

1. Emergency Response: Stop payments, block accesses, save logs.

2. Preservation & Forensics: Removal of data images, recovery of deleted information, legally correct collection of evidence.

3. Asset Tracing & Freezing (Search and Freezing) Identification of accounts and property, applying to the court for interim measures.

4. Legal Strategy: Choice between criminal application, arbitration, civil fraud lawsuit, and negotiation.

5. Governance & Communication: Risk assessment for the company, disclosure plan to regulators, public statements and control reform.

Without the first track, the rest of us could lose the subject of the investigation. Without a third, you can win on paper without real money.

FAQ

Can an employee be fired on suspicion of fraud until the investigation is completed? However, dismissal before evidence is collected can lead to lawsuits for wrongful termination.

When to report to the police?The decision depends on the location of assets and jurisdiction. Sometimes, an urgent criminal case is the only way to quickly arrest accounts. In other cases, law enforcement officers can paralyze the company’s business processes.

For materials to be protected, the formal customer must be an external legal adviser, and reports should be prepared for legal analysis, not just for the minutes of the board of directors.

What to do if the stolen funds are transferred to cryptocurrency?It is urgent to attract specialists in blockchain analysis. Despite anonymity, many exchanges comply with KYC/AML requirements, and with a quick reaction, there is a chance to freeze funds on the wallet or at the time of the exchange.

Yes, if there is evidence of breach of fiduciary duty, conspiracy or unjust enrichment. This is often a more effective way to go than to sue a layered company that has no assets.

Most policies (Crime/Fidelity) contain strict deadlines for notification of potential loss. Procrastination may result in a refusal to pay.

What's more important at the beginning: Finding the culprit or stopping the money leak?For a business, the priority is to stop the losses and find assets. Identifying the culprit is a secondary, albeit related, task.

Related services

• Corporate Investigations, Regulatory Investigations & Business Integrity
• Asset Tracing & Fraud Recovery
• International Arbitration, Commercial Litigation & Cross-Border Disputes
• Sanctions, Export Controls & International Compliance
• International Insolvency & Asset Restructuring
• White Collar Crime & Individual Defense

Related material

• Asset tracing: How to find the debtor’s assets, acting imperceptibly
• Interim measures in international commercial disputes
• How to build a compliance system that really works
• Protection of whistleblowers in the international holding
• Computer forensics (IT-forensic): How not to ruin the evidence
• Directors’ Liability for Corporate Fraud
• Recognition and enforcement of foreign fraud judgments
• Why Without an External Advocate Your Internal Investigation Is a Gift to Opponents
• Risks of parallel investigations in the US, EU and CIS

Conclusion

Investigating corporate fraud requires not a standard staffing review, but a strategy to preserve the value of the business.

Success is based on the speed of legal reaction, technological forensics, immediate asset search and professional protection of the evidence base.

In corporate fraud cases, the winner is not the first to report to the police or collect dirt. The winner is the one who, in the first hours after the discovery of the scheme, already understands where the money is, how to return it and how to turn the “gray” operation into irrefutable legal facts.