acfe course materials - fraud conference · “acfe,” “fraud magazine,” “cfe exam prep...

Conducting Internal Investigations: Planning and Logistics

Welcome!The ACFE would like to welcome you to Conducting Internal Investigations: Planning and Logistics. We hope you will find this course informative and immediately useful. The materials in this book will not only supplement your learning experience during the class, but will also serve as a reference and reminder for you when you are back on the job.

There are a few important administrative items to keep in mind:

• Timing and Structure — Class will start promptly at 1:00 p.m. and end at 5:00 p.m. each day. Beverages, continental breakfast, and one group lunch will be provided.

• Sign-In Sheet — Please initial next to your name on the Sign-In Sheet. It is critical that you do so each morning to be eligible for CPE credit.

• Certificate of Attendance — Please complete the CPE Reporting Form found inside your registration packet. This form is due on the last day of the seminar and will serve as your Certificate of Attendance. Return the top white copy to the Registration Desk and keep the bottom yellow copy for your records. The yellow copy will serve as your Certificate of Attendance.

• Evaluations — Course evaluations will be distributed by email. Please take time to provide feedback about the course, venue, and instructor. Your evaluation will help the ACFE make improvements to future training courses. At the conclusion of the evaluation you will receive a link to all the PowerPoint slides used throughout the class.

Thank you for attending. Please let us know if there is anything we can do to make your experience in this class more comfortable, productive, and valuable.

ACFE Course Materials

©2012 by the Association of Certified Fraud Examiners, Inc.

Revised 5/21/12

No portion of this work may be reproduced or transmitted in any form or by any means

electronic or mechanical, including photocopying, recording, or by any information

storage and retrieval system without the written permission of the Association of Certified

Fraud Examiners, Inc.

“Association of Certified Fraud Examiners,” “Certified Fraud Examiner,” “CFE,”

“ACFE,” “Fraud Magazine,” “CFE Exam Prep Course,” “EthicsLine,” the ACFE Seal,

and the ACFE Logo are trademarks owned by the Association of Certified Fraud

Examiners, Inc.

WORLD HEADQUARTERS, THE GREGOR BUILDING

716 WEST AVENUE AUSTIN, TX 78701-2727 USA

TEL: (800) 245-3321 +1 (512) 478-9000

FAX: +1 (512) 478-9297

WWW.ACFE.COM

DISCLAIMER

Every effort has been made to ensure that the contents of this publication are

accurate and free from error. However, it is possible that errors exist, both

typographical and in content. Therefore, the information provided herein

should be used only as a guide and not as the only source of reference.

The author, advisors, and publishers shall have neither liability nor

responsibility to any person or entity with respect to any loss, damage, or

injury caused or alleged to be caused directly or indirectly by any information

contained in or omitted from this publication.

Printed in the United States of America.

http://www.acfe.com/

Association of Certified Fraud Examiners

23RD ANNUAL ACFE FRAUD

PRE-CONFERENCE

CONDUCTING INTERNAL INVESTIGATIONS:

PLANNING AND LOGISTICS JUNE 17, 2012

ORLANDO, FL

11:00 a.m. – 1:00 p.m. Registration: City Hall Lobby

Room Name: Sun Ballroom A

1:00 p.m. – 2:10 p.m. Responding to the Allegations: The First 24 Hours

2:10 p.m. – 2:25 p.m. Break

2:25 p.m. – 3:35 p.m. Building the Fraud Examination Team

3:35 p.m. – 3:50 p.m. Break

3:50 p.m. – 5:00 p.m. Project Management and Fraud Examinations

Leah Lane, CFE

Global Investigations Manager

Texas Instruments, Inc.

Leah Lane has more than 20 years of combined public and private sector investigations

and fraud examination experience. During her career, she has managed, worked, and assisted

in hundreds of investigations globally, involving allegations of Foreign Corrupt Practices Act

violations, internal and external fraud, and employee misconduct.

Leah is currently the Global Investigations Manager at Texas Instruments, Inc, where she

manages a group of investigators with global responsibility for investigations within TI. She

is also responsible for fraud awareness campaigns.

Before joining Texas Instruments, Leah served as the Audit Fraud Manager at jcpenney

and as a Security Manager for the Americas at HP/EDS. At these positions, she was

responsible for investigating and managing complex financial fraud and computer forensic

matters. She began her investigative career as a special agent in the U.S. Customs Service, a

position she held for more than seven years.

Leah is a Certified Fraud Examiner (CFE) and a Certified Fraud Specialist (CFS), and

holds a BS in Criminal Justice from the University of Southwestern Louisiana. She is an

active member of the Association of Certified Fraud Examiners, the Association of Certified

Fraud Specialists,and The Institute of Internal Auditors. Leah also serves on the ACFE

Advisory Council.

TABLE OF CONTENTS


©2012 i

PRACTICAL PROBLEMS

Practical Problems 1–3 ......................................................................................................... PP-1

RESPONDING TO THE ALLEGATIONS: THE FIRST 24 HOURS

Introduction ..................................................................................................................................1

What to Do When an Allegation of Fraud Arises ........................................................................1

Avoid Tipping Off the Fraudster .................................................................................................10

Identify the Investigation Leader .................................................................................................11

Contact the Complainant..............................................................................................................12

BUILDING THE FRAUD EXAMINATION TEAM

Introduction ..................................................................................................................................15

Structure the Investigation Team to Preserve Confidentiality .....................................................15

Identify What Skills Are Needed to Conduct the Investigation ...................................................18

Internal Versus External Expertise ...............................................................................................19

Select the Team ............................................................................................................................20

Do’s and Don’ts for Selecting Team Members ...........................................................................25

Allocate Necessary Resources .....................................................................................................26

Managing the Fraud Examination Team ......................................................................................27

PROJECT MANAGEMENT AND FRAUD EXAMINATIONS

Introduction ..................................................................................................................................31

Outlining the Course of Action ....................................................................................................31

Identifying Phases, Tasks, and Checkpoints ................................................................................33

Planning the Investigation............................................................................................................35

Dealing with Underperforming Team Members ..........................................................................42

Keeping Your Team Informed and on Task ................................................................................46

Monitoring the Progress of the Investigation...............................................................................49

Managing Conflicting Resources and Demands for Time ...........................................................50

PRACTICAL PROBLEM 1


©2012 PP-1

You are a CFE working for Obsidian Industries, a company that makes industrial-size fans.

Obsidian Industries receives a call through its fraud hotline stating that it should take a close look at

Steven Browning. The caller says Browning is giving favorable treatment to, and possibly receiving

favorable treatment from, Copius Copper, a vendor that sells copper wiring to Obsidian. The caller

says he has reason to believe that Browning is a part owner of Copius Copper. The caller does not

provide any other information.

Management at Obsidian Industries decides to conduct an initial assessment into the allegations to

determine if a formal investigation is needed and what steps, if any, are required to respond in an

appropriate manner.

Questions:

1. How should members of Obsidian’s management respond to the allegations? What initial

actions should the company take? What steps should the company take in evaluating these

allegations?

2. What are some key questions that the initial assessment should be designed to answer?

3. What can Obsidian Industries do to avoid tipping off culpable employees?

PRACTICAL PROBLEM 2


©2012 PP-3

Wilson Aerospace is a publicly traded company. Over the weekend, someone called the company’s

hotline service and said, “Your CFO is cooking the books. Last quarter’s earnings were inflated.”

The caller refused to give his name or provide any further information.

The CFO is Richard Harris. He is the brother-in-law of the Wilson Aerospace’s CEO and founder,

Bruce Wilson.

After receiving the hotline tip, the management of Wilson Aerospace conducted an initial

assessment. The assessment uncovered additional facts that lent credibility to the whistleblower’s

allegations. Consequently, the company’s management decided to conduct a formal fraud

investigation into the potential for fraud within the financial reporting function.

The company’s legal counsel hires you, an outside fraud examiner, to conduct the fraud

examination.

PRACTICAL PROBLEM 2


©2012 PP-4

Questions:

1. What kinds of skills are needed to complete the investigation?

2. Whom will you include on your investigative team?

3. Do you think that outside consultants will be necessary? If so, what types might you need?

4. What steps can you take at this stage to help protect the confidentiality of the investigation?

PRACTICAL PROBLEM 3


©2012 PP-5

Refer to the facts of Practical Problem 1, which involved Obsidian Industries, and assume that the

company conducted an initial assessment that uncovered additional facts that lent credibility to the

whistleblower’s allegations. Specifically, Obsidian learned that Copius Copper is not on the

company’s approved vendor list, its address is a PO Box, and it is owned by two individuals, Roger

Smith and S. Jeremy Browning. Obsidian also learned that the whistleblower was Johnson, the

company’s accounts payable supervisor.

Accordingly, Obsidian’s management decides to conduct a formal fraud investigation into the

potential for fraud, and it assigns you the task of leading the investigation.

Based on these new facts, answer the following questions.

PRACTICAL PROBLEM 3


©2012 PP-6

Questions:

1. Develop an investigative plan that outlines your course of action. Consider the goals, likely

procedures, deadlines, staffing needs, and period.

2. What legal problems, if any, do you anticipate as part of this fraud examination? What will you

do to avoid them?

3. Who are you planning to interview and in what order? How will you schedule the interviews

and where would you conduct them?

4. Where are the most likely places that you will find relevant evidence?



©2012 1

NOTES Introduction

When an allegation of misconduct arises, management

must respond in an appropriate and timely manner. And

during the initial response, time is critical. Therefore, fraud

examiners must be prepared to address a number of issues

in a short amount of time and sometimes under stressful

conditions.

This section explores the first steps that organizations and

fraud examiners should take when an allegation of fraud is

brought forward.

What to Do When an Allegation of Fraud Arises

Initially, when an allegation of fraud is arises, management

should respond quickly. The failure to act quickly against

suspicions of fraud could result in civil litigation, enhanced

penalties under the U.S. Sentencing Guidelines, and

enforcement actions by federal and state regulators.

Responding to an allegation of fraud, however, will vary

depending on the facts. The appropriate response will

depend on how the allegation came about (e.g., internal

sources, civil lawsuit, investigation by the government,

etc.).

Generally, when there is an allegation of fraud,

management will want the following questions answered:

Does the alleged activity constitute fraud?

Who is involved?

How should those who were involved in the fraud be

handled?

Are there any co-conspirators?

How much was lost to fraud?

During what period did the fraud occur?

How did the fraud occur?

How was the fraud identified?



©2012 2

NOTES Could the fraud have been detected earlier?

What can be done to prevent similar frauds?

Should the conduct be disclosed to the authorities?

To help answer these questions, management must act

swiftly. Specifically, it should take the following actions

when it receives an allegation of fraud:

Engage legal counsel.

Notify proper executives.

Preserve relevant documents and electronic records.

Identify who should be involved in the matter.

Conduct an initial assessment to determine if an

investigation is needed and what steps, if any, are

required to respond in an appropriate manner.

Stop the activity in question, if appropriate.

Engage Legal Counsel

Because fraud examinations are riddled with legal

uncertainties, management should consult with internal

and possibly external local legal counsel before making

any decisions or taking any action concerning the

suspected conduct.

Notify Proper Executives

If the preliminary investigation reveals that fraud has

occurred, management should notify proper executives

and, if appropriate, the entity’s board of directors.

Some companies have investigative protocols or ethics

and compliance responsibility matrices that define

exactly which executives should be notified about

specific types of events or violations. These forms

outline notification principles and escalation triggers

that vary depending on the nature and severity of the

allegations.



©2012 3

NOTES Example of Investigative Protocols

Preserve Relevant Documents

When evidence of fraud arises, management should

work with the Legal Department to issue a litigation

hold to ensure that all relevant documents, including

those stored electronically, are preserved. In a fraud

investigation, the term documents typically refers to,

but is not limited to, contracts, invoices,

correspondence, memoranda, weekly reports,

presentations, telephone messages, emails, reports,

performance reviews, performance improvement plans,

medical records, and any other written or recorded

material. A litigation hold refers to the steps a company

takes to notify employees to suspend the destruction of

potentially relevant records.

Litigation hold procedures are necessary to ensure that

potentially responsive documents are not destroyed

once evidence of misconduct arises.

The failure to preserve relevant evidence could have

several adverse consequences, including, but not

limited to, the government’s questioning of the integrity

of any fraud investigation, monetary fines and



©2012 4

NOTES sanctions, adverse inference jury instruction sanctions,

or dismissal of claims or defenses.

To develop litigation hold procedures, management

must examine how information moves through the

company, determine how to identify the materials

relevant to a particular issue, and develop a process that

ensures such information can and will be preserved.

Moreover, the procedures must be designed to ensure

that all documentary and electronic information that

potentially could be relevant to the investigation is

preserved.

Even though litigation holds should apply to both

electronic data and physical documents, electronic data

contains certain attributes that make executing a timely

litigation hold more difficult. Specifically, electronic

data might only be available for an evanescent time

period, business practices are often designed to free up

storage space by deleting this type of information,

electronic data can reside in numerous locations, and

identifying relevant electronic data within today’s large

and complex data systems can be challenging and

costly.

A key objective to any litigation hold is to ensure that

the company, or the individuals, stops any automatic

document deletion programs or rules that might be in

place for electronic records.

Moreover, if the company operates on an international

scale, there will be additional difficulties for executing

a timely litigation hold.



©2012 5

NOTES Therefore, management should consider retaining an

outside expert to assist in searching for and preserving

electronic data.

In general, the details of litigation hold policies should

be developed so the organization can:

Promptly notify employees who might possess

relevant documents.

Issue a preliminary hold order to all individuals and

employees who might possess relevant information

(i.e., custodians).

Promptly notify information technology (IT)

personnel and get their involvement if electronic

data is at issue.

Notify custodians and IT personnel of their duty to

preserve.

Suspend any deletion protocols.

Prohibit the destruction, loss, or alteration of any

potentially relevant documents.

Prohibit employees from destroying, hiding, or

manipulating documents.

Alert employees about the risk to the company and

the employees if they fail to heed the litigation hold

request.

The notice should be in writing, and it should be written

in a clear manner that is easy for non-legal and non-

technical employees to understand.

Moreover, establishing a litigation hold will help those

involved in an investigation identify the relevant

sources of information more quickly, and it will help

them understand the technology options available for

searching, analyzing, and reviewing data.



©2012 6

NOTES Identify Who Should Be Informed

Several departments should be interested in fraud,

including legal, human resources, internal audit,

security, risk management, and loss prevention. When

responding to an allegation of fraud, it is important to

consider the interests of each of these departments.

Typically, the general counsel should be made aware of

any significant fraud that may result in legal action.

Human resources (HR) deals with issues involving

unfair treatment, discrimination, harassment, substance

abuse, or concerns about corporate policies. Therefore,

the HR department should be informed of fraud that

affects any such areas.

Information distribution rules must be developed, and

several departments may be involved in this process.

Both the HR and legal departments should be involved

to ensure that the right people receive information in a

timely manner. Other departments, such as loss

prevention or risk management, audit, and security,

might need to be involved. These distribution rules

should already be set when investigation protocols are

in place.

The IT department should be part of an investigation to

safeguard data until it can be analyzed. IT personnel

can also help identify what data is available and where

it is located. Some IT staffers can even function as

forensic investigators if they are licensed to do so.

Identifying who should be informed is necessary to

ensure that designated executives are notified

immediately to enable a prompt response.



©2012 7

NOTES Conduct an Initial Assessment

Usually, when an allegation of fraud arises, there are

not enough known and verified facts to begin a formal

investigation and, therefore, management should

conduct an initial assessment to determine if an

investigation is needed and what steps, if any, are

required to respond in an appropriate manner. This

question is perhaps the most critical question that

management must answer when an allegation of fraud

arises.

To be of value, an initial assessment of suspicious

activity must be thorough and balanced, and it must be

conducted with intent to verify the facts.

Also, to avoid any real or perceived downplay of the

matter’s significance and to avoid any attempts at

willful blindness, the assessment’s findings must be

documented and reported accurately.

Moreover, the assessment, like any investigation,

should be conducted under the direction of counsel.

Unlike a formal investigation, however, the initial

assessment should be a limited, fact-finding analysis,

and it should focus on the specific allegation or

incident.

Therefore, if possible, the assessment should address a

number of questions, including:

Is the allegation credible?

Who is the subject of the allegation and what is his

relationship to the company?

What was the business purpose of the activity

related to the allegation?

How serious is the allegation?



©2012 8

NOTES What levels of employees are alleged to be

involved, if any, in the misconduct (i.e., officers,

directors, or managers)?

Did any third parties receive any direct or indirect

benefit from the misconduct, and, if so, who are

they?

If a third party is involved, is the third party a

government official?

How was the matter recorded on the company’s

books and records, if applicable?

Can it be determined if the person in question acted

with fraudulent intent?

Is it possible that the issue might be larger than

expected?

Were there any whistleblowers, and, if so, how

should they be dealt with?

What measures should the company take to

document how the initial evidence of wrongdoing

was handled?

Is the government already involved, and if not, is it

likely that the government will become involved?

Is it likely that the matter will have significant

negative impact on shareholder value?

Once management has assessed the issues listed above,

it can decide what actions to take.

In addition, the decision as to the appropriate response

can be influenced by other factors. Like any business

decision, the cost of conducting the investigation must

be considered; however, in many cases, the cost of not

conducting an investigation will be higher in the end.

Moreover, management should consider whether an

investigation will interrupt business activity. If

management decides against conducting an



©2012 9

NOTES investigation, it must document the reasons why it

chose to do so.

More specifically, the initial assessment should focus

on:

Determining if fraud occurred

Identifying the status of the fraud

Reviewing any applicable policies and procedures

Identifying potential claims and offenses

DETERMINE IF A FRAUD OCCURRED

The initial assessment should determine if a fraud

occurred. When making this determination, it is

important to differentiate between inadvertent

violations and those carried out with deliberate

criminal intent, which is an essential element of

fraud.

IDENTIFY THE STATUS OF THE FRAUD

The initial assessment should determine the status

of the fraud. This decision should be based in part

on answering all of the following questions:

When did the fraud begin?

Where did the violation come from? Was it

internal or external?

Is the fraud still occurring?

If the fraud is no longer occurring, when did it

stop?

REVIEW ANY POLICIES AND PROCEDURES

Those involved in the initial assessment must also

review any applicable internal controls and

company policies, including any anti-fraud auditing

and testing policies and procedures, to determine

the best method and processes for continuing the

investigation.



©2012 10

NOTES IDENTIFY POTENTIAL CLAIMS AND OFFENSES

When conducting the initial assessment, the fraud

examiner should consider the potential claims and

offenses—civil, criminal, and administrative—that

might be involved in the case.

Identifying potential claims and offenses is

important because fraud examiners are concerned

with fraud recovery. In practical terms, this means

examiners must be able to recognize which laws

were potentially violated, and they must be able to

match the facts and circumstances of a specific loss

to one or more legal causes of action. This will be

the legal theory of recovery.

Stop the Activity in Question

When management receives an allegation of suspicious

activity, it must stop whatever is happening from

continuing to happen.

Avoid Tipping Off the Fraudster

When responding to an allegation of fraud, those

responsible for investigating the allegation must avoid

tipping off the fraudster.

If the fraudster is tipped off, a number of different adverse

events might occur. For example, the fraudster could

attempt to destroy or alter evidence, making it more

difficult to conduct the investigation. When investigation

details are leaked, concealment and destruction of evidence

typically occur at a faster rate than if the investigation is

kept quiet.

Additionally, a tipped off fraudster might attempt to flee,

cut contact with associates, or point the blame at somebody

else. Some companies have processes in place to prevent a



©2012 11

NOTES fraudster from engaging in such conduct. For example,

some companies can suspend the suspect pending the

outcome of the investigation. This capability, however,

typically depends on the individual’s position in the

company.

If the suspect does find out about the investigation,

management will have to adjust the timeline accordingly,

which might mean interviewing the suspect earlier than

planned.

The confidentiality of an internal investigation is critical.

Who in the company has access to the investigative data,

files, and information? Do employees have to sign

confidentiality forms when they are interviewed? Are there

consequences if confidentiality is breached and

investigation details are leaked staff members?

Accordingly, it is important to be knowledgeable about

your organizations guidelines or policies. Do the applicable

internal investigation guidelines or policies have a “need to

know” clause and an “all access” clause? These clauses

allow you to keep the details of the investigation

confidential and grant the investigator access to necessary

company systems to gather evidence. Likewise, it is

important for an examiner to know whom he is

investigating and what he can access.

Identify the Investigation Leader

When an allegation of fraud arises, management must

designate someone to lead the initial assessment and

investigation. A leader should have investigative

experience and knowledge of legal and compliance

requirements regarding the specific type of allegation.



©2012 12

NOTES The leader should be chosen based on the allegation.

Management should consider whether to appoint an

internal resource (if available) or an external third party.

The leader should be independent of the activity affected

by the alleged fraud and have the means to recruit resources

necessary to conduct the investigation, sufficient authority

and access to gather any necessary information, and the

ability to communicate with senior management.

Contact the Complainant

If the allegation came in through a tip from an identified

source, the whistleblower should be contacted in case he

has additional information and to confirm his willingness to

continue to help throughout the investigation.

An interview with the complainant should seek to

determine:

What the complainant knows

How the complainant got the information

Who were the key individuals involved

When the alleged events occurred (e.g., dates, times,

and locations)

What evidence exists to corroborate the alleged events,

where is the evidence located, and how the evidence be

can accessed

What witnesses can corroborate the alleged events

What the motivation behind the alleged events was

Why the alleged actions were improper

Even if the allegation was anonymous, management or the

investigative team should try to contact the complainant.

Some hotlines have the ability to provide a complaint

number and a phone number to the anonymous caller so he

can call back to check the status or to provide additional



©2012 13

NOTES information. Put follow-up questions in place if the tipster

does call back.

Also, if he uses an anonymous email address for contact,

then send an email with follow-up questions to that address

and see if you get an answer.

Obviously, this is a shot in the dark and might not provide

additional information, but at least the possibility exists that

more information could be gathered.

If the complainant reports an issue to a hotline and wants to

remain anonymous, then the company should investigate to

the extent they can with the information provided.



©2012 15

NOTES Introduction

Once it is determined that an allegation or issue will be

investigated and management has chosen the appropriate

party to own the investigation, consider what other parties

should compose the examination team.

The findings and observations collected up to this point

should be the primary factors used to determine who should

be involved in the investigation.

Structure the Investigation Team to Preserve

Confidentiality

If confidentiality issues are not given attention from the

outset of the examination, an organization might find itself

without options by the time third parties try to access

investigative materials. Certain evidentiary privileges and

discovery rules that offer the best basis for preserving

confidentiality depend largely on how the information was

gathered and secured by the team.

Therefore, to prevent third parties, including the subject of

the investigation, from gaining access to the examination

materials, management should consider conducting the

investigation under the attorney-client privilege and the

attorney work product doctrine. But to receive such

protections, the investigation must be conducted at the

direction of, or under the supervision of, legal counsel. The

findings from investigations not conducted under the

attorney-client privilege or the attorney work product

doctrine may be discoverable by private litigants as well as

government regulators.

Consider Implementing the Attorney-Client Privilege

The attorney-client privilege is an evidentiary privilege

that protects against involuntary disclosure of

communications between clients and their attorneys.



©2012 16

NOTES This privilege provides a valuable defense against third-

party attempts to discover materials.

The general rule is that the attorney-client privilege

only applies to confidential communications (verbal or

written) between a client and his attorney for the

purpose of giving or receiving legal advice, but courts

have extended the privilege to include client

communications with non-lawyers (e.g., fraud

examiners) who are working under the direct

supervision, direction, and control of the lawyer.

Communications will generally be protected under the

attorney-client privilege if the following elements are

present:

Confidential communications (oral or written)

Between an attorney and client (or vice versa)

Made for the purpose of giving or receiving legal

advice

Communications do not need to take place after a

lawsuit has been filed to be privileged, but if they do

not meet all of the above criteria, they are not

privileged.

The attorney-client privilege, if properly implemented,

provides some protection from discovery of internal

reports by the subject of the investigation, the

government, or third parties. The privilege also helps

protect the confidentiality of witnesses. However, it

does not protect the underlying evidence or documents

that do not meet the criteria outlined above, and it

cannot be claimed retroactively to cover work done

before counsel was involved.



©2012 17

NOTES Consider Implementing the Attorney Work Product

Doctrine

The attorney work product doctrine offers limited

protection for tangible materials (e.g., work papers,

interview notes, or memos) that are prepared at the

direction of counsel and in anticipation of litigation.

The work product doctrine is designed to protect the

thoughts and strategies of counsel, so work papers,

interview memos, or verbatim transcripts that do not

reflect such matters might not be protected.

The protection afforded by the work product doctrine

not only extends to information and documents

prepared by a party or the party’s attorneys—it may

also apply to materials prepared by consultants and

experts who were hired by the attorney. Accordingly,

the rule might protect the work product of a company’s

fraud examiner if the examiner’s work was conducted

in anticipation of possible litigation.

As stated above, the work product privilege only

protects tangible materials that are prepared in

anticipation of litigation. Litigation must be actually

planned and the work for which protection is sought

must have been undertaken for the specific purpose of

preparing for that litigation.

When a fraud examination is conducted in response to

known or suspected employee misconduct, it will

generally qualify as work done in anticipation of

litigation. If the investigator is merely auditing the

company’s procedures to ensure against the possibility

of future losses, however, the work product of the audit

probably will not be protected.



©2012 18

NOTES Identify What Skills Are Needed to Conduct the

Investigation

To determine who should be involved in the investigation,

identify what skills are needed. Fraud examinations usually

require a cooperative effort among different disciplines.

Auditors, fraud examiners, managers, attorneys, security

personnel, and others are all frequently associated with

fraud investigations.

Selecting the right team members is essential to conducting

an effective fraud examination. When choosing the

participants, identify those who can legitimately assist in

the investigation, who have a legitimate interest in the

outcome, and who have the skills needed for the specific

case.

The team should work together to minimize risks and

losses associated with the fraud. This will increase the

chances of a successful investigation.

Consider all of the implications that can arise from an

investigation. These implications include the business,

legal, human resources, and operational factors that arise

when an investigation commences. Addressing these

potential issues up front will ensure that significant factors

(e.g., the team members’ abilities, the leading executives,

and the assurance of independent action and reporting) are

considered.

If the team does not have guidelines or protocols in place to

ensure that the attorney-client privilege and attorney work

product doctrine are not compromised during the

investigation, members should establish such protocols

with the assistance of legal counsel.



©2012 19

NOTES The team should be composed of professionals with the

skills to deal with various types of incidents. To acquire the

appropriate level and mix of skills, the team should include

internal resources (if available) and external resources, if

needed or appropriate.

Typically, team members should have:

Accounting and audit knowledge

Knowledge of the industry

Knowledge of the organization

Knowledge of the laws and rules of evidence in the

jurisdiction where the fraud occurred

Knowledge about privacy issues in the jurisdiction

where the fraud occurred and where the investigation

will occur

An understanding of psychology and motivational

factors

Interviewing skills in the suspect’s native language

Communication skills

Computer skills

A successful fraud examination, however, depends not only

on the knowledge and skills of individual members, but

also on the individual team members’ characteristics that

facilitate team interaction and functioning. These

characteristics are especially critical for teams that require

more coordination.

Internal Versus External Expertise

When building a team, you should determine whether

outside expertise is needed or whether it is available in-

house. To choose between internal or external specialists,

weigh the advantages between the two.

In some cases, particularly when the suspect is a powerful

or popular employee, it might be useful to employ outside



©2012 20

NOTES specialists who are relatively immune from company

politics or threats of reprisals.

Outside experts might also have greater experience and

investigative contacts than insiders, which gives them more

influence with senior executives who may prefer input from

outsiders. Additionally, using outside experts gives the

fraud examination the appearance of independence, and this

can be very important when reporting to or dealing with the

government.

Conversely, insiders often provide certain benefits. Insiders

have an in-depth knowledge of the organization, its

workings, its culture, and its processes and procedures.

Consequently, insiders might be better suited for evaluating

the significance of evidence, or its absence, than outsiders.

Also, insiders often know the personalities of those

involved.

Select the Team

Once you have identified the skills needed to conduct the

investigation, select the team. A typical fraud examination

might include the following professionals:

Certified Fraud Examiners (CFEs)

Legal counsel

Local international counsel

Accountants or auditors (internal or external)

Audit committee members

Security personnel

Human resources (HR) personnel

A representative of management

Information technology (IT) personnel

Computer forensic experts

E-discovery specialists

External consultants



©2012 21

NOTES Certified Fraud Examiners

Certified Fraud Examiners (CFEs) are trained to

conduct complex fraud cases from inception to

conclusion. A CFE has training in all aspects of a fraud

examination and therefore can serve as a valuable

“hinge” to the investigation team, tying together the

financial examination and the more traditional

investigative techniques.

Legal Counsel

It is crucial to have counsel involved in and, in most

cases, “directing” fraud examinations, at least as far as

the legal aspects of the process are concerned (e.g.,

reporting the results, preserving confidentiality,

avoiding lawsuits, or terminating employees for

wrongful misconduct). Fraud examination can be a

veritable hornet’s nest of legal questions, and the team

must have counsel on hand to sort through them,

otherwise the company risks exposing itself to greater

danger than the threat it is investigating.

In addition, by having an attorney directing or

overseeing the investigation, the company might be

able to protect the confidentiality of its investigation

under the attorney-client privilege and the work product

doctrine.

Local International Counsel

Management should obtain the help of local

international counsel before beginning a fraud

examination abroad.

Local international counsel is needed to address a

number of various issues that arise when working in

foreign jurisdictions. For example, local counsel will be

able to provide advice concerning applicable privileges



©2012 22

NOTES in the foreign jurisdiction. Likewise, consulting with

local counsel can provide guidance as to whether local

laws afford employees privacy rights that might

interfere with the investigation.

Accountants or Auditors

Because accounting and audit knowledge is necessary

to most fraud examinations, a team might include

accountants or auditors, whether internal or external.

Auditors can support the investigation with information

on company procedures and controls. Internal auditors

are often used to review internal documentary evidence,

evaluate tips or complaints, schedule losses, and

provide assistance in technical areas of the company’s

operations. Additionally, auditors can assess the

probable level of complicity within the organization,

and they can help design procedural methods to identify

the perpetrators and help determine the extent of the

fraud.

Audit Committee Members

As a result of the passage of the Sarbanes-Oxley Act,

audit committees are taking a more active role in

internal investigations. This has occurred, in part,

because the Sarbanes-Oxley Act mandates that audit

committees for publicly traded companies be directly

responsible for two key components of an effective

fraud prevention program—outside audits and internal

reporting mechanisms. Accordingly, a company’s audit

committee may actively oversee a fraud examination or

require that the investigation team report directly to it.

Security Personnel

Security department investigators are often assigned the

investigation’s fieldwork responsibilities, including



©2012 23

NOTES interviewing outside witnesses and obtaining public

records and other documents from third parties.

Human Resources Personnel

The human resources department should be consulted

to ensure that the laws governing the rights of

employees in the workplace are not violated. Such

involvement will lessen the possibility of a wrongful

discharge suit or other civil action by employees.

Although the team might need advice from a human

resources specialist, normally this person would not

directly participate in the investigation.

A Representative of Management

A representative of management or, in significant cases,

the audit committee of the board of directors, should be

kept informed of the progress of the investigation and

should be available to lend necessary assistance.

Information Technology Personnel

If fraud occurs, it is likely that a computer was

involved; if so, IT personnel may need to be part of an

investigation to help identify and locate available data

and safeguard it until it can be analyzed.

Computer Forensic Expert

When developing a fraud examination plan,

management should determine whether a computer

forensic expert is needed. Due to the sensitivity of

digital evidence, the team should include a computer

forensic expert if an investigation involves more than

cursory analysis of electronic evidence.

Computer forensic experts can uncover a large amount

of data that relates to the use of a computer, what is or



©2012 24

NOTES has been stored on it, and the details about the

computer’s users.

Also, it is important to allow a trained examiner to

conduct a proper seizure and examination on digital

evidence to help ensure that the information can be

used in legal proceedings.

Within the computer forensic field, there are several

different types of experts:

Operating and file system experts: These experts are

proficient in certain operating systems (e.g.,

Windows 7, Unix, Solaris, OS X, or AS400) and the

various file systems they employ (e.g., Joliet,

NTFS, FAT, VFS, Ext2), and they have the ability

to convey operational characteristics and observe

artifacts.

Data recovery experts: Using special tools and

equipment, these experts can salvage data from

damaged, failed, corrupted, or inaccessible media.

Forensic accounting experts: A forensic accountant

can provide various services, including audits,

accountant performance reviews, and examinations

of financial documents for fraud, misconduct, or

industry standard violations.

Tape and archival extraction experts: Tape and

archival extraction experts are knowledgeable in

extracting information from tape or other system

backups. Typically, backup solutions archive data in

proprietary formats, making extraction very

cumbersome.

Intrusion and malicious code experts: These experts

specialize in investigating computer network

intrusions. Specialists can determine attack vectors,

the tools employed, what occurred during access,

and what, if anything, was taken.



©2012 25

NOTES Given the diversity of computer-related fraud, no

person can be an expert in all aspects of computer

technology.

Moreover, in cases involving litigation, a forensic

expert can help parties draft interrogatories and requests

for production designed to solicit relevant data. They

can also help prepare and participate in depositions

involving record custodians.

E-Discovery Specialists

E-discovery and data-preservation specialists can

provide technical expertise in managing and reviewing

electronic data. These specialists use sophisticated tools

to search and analyze mounds of data for keywords,

phrases, names, dates, and other information that will

help identify potential indicators of fraud. Moreover, e-

discovery specialist can help ensure that all relevant

records are preserved.

External Consultants

When conducting a fraud examination, examiners

should determine whether an external consultant is

needed. Consultants are particularly helpful when the

suspect is in a position of power.

Do’s and Don’ts for Selecting Team Members

This discussion summarizes the do’s and don’ts for

selecting team members. Some of the basic do’s include:

Consider the team’s size.

Check for any conflicts of interest between internal and

external team members.

Ensure there are no reporting issues (e.g., a team

member feels pressure to report all details of the

investigation to his direct manager, even though the

manager does not have a need to know). Reporting



©2012 26

NOTES issues can be prevented by establishing confidentiality

rules in the beginning of the investigation.

Select members who fit the investigation’s demands

and objectives.

Recruit team members with the skills needed to conduct

the investigation.

Recognize the unique knowledge, experience, and skills

that each team member can contribute.

Contemplate the ways that each potential member will

fit into the team.

Select people who will work well with other team

members.

The don’ts for selecting team members include:

Don’t select team members based on friendship.

Don’t select team members to repay a favor.

Don’t select team members with negative attitudes.

Don’t overlook team members with untraditional

knowledge that can contribute to the investigation (e.g.,

people with experience in a particular industry).

Don’t select members who might have personality

conflicts with other members.

Allocate Necessary Resources

As with any special investigation or operation that requires

advance preparation, the planning process must include

efforts to adapt the resources needed to deal with the

variety of issues that might occur during the examination.

This is especially true if the relevant operations are in

developing economies, remote locations, or areas with a

higher risk of security-related incidents.

Management should also identify resource limitations so

that the team can meet realistic objectives and develop

alternative strategies.



©2012 27

NOTES Managing the Fraud Examination Team

As with participants in most group efforts, members of a

fraud examination team need to work together to capitalize

on their strengths and produce the best results.

A team approach to examinations is often more productive

than an individual approach. However, teams comprise

individuals who bring different values, beliefs, agendas,

and experiences to the group. This can lead to challenges,

but it can also provide new insights and foster learning

among the members.

Although working in teams is often a superior technique for

learning and problem solving, these benefits can be lost if

there is dysfunction among the individuals (e.g., there is

unequal participation by the team members, or one group

member dominates the team’s efforts). Team performance

is dependent on a variety of factors and qualities within the

group and for a team to achieve its goals, each member

must work together. A poorly functioning team likely will

elevate members’ stress levels more than if an individual

was working alone.

In a team examination, members must focus their attention

on the final collective goal, even though all the members

will have different specialties that are applied toward the

goal.

Effective teamwork, however, does not come easy for those

who were educated and trained in different disciplines or

who work in different fields or departments. Although

varying traits can serve a client or employer well in a fraud

examination, the same traits can be counterproductive when

establishing a consensus with colleagues on the best

strategy. Thus, to conduct a successful fraud examination, a

team must be more than just a collection of individuals.



©2012 28

NOTES Characteristics of Effective Teams

Effective teams share certain characteristics, including:

Mutual trust

Respect for team members

High level of commitment

Mutual support for each other

Appreciation for others’ strengths and reduction of

their weaknesses

Effective communication

Clarity in the team’s objectives

Productive conflict resolution

Environment that encourages respect for individual

differences

Organization

Flexibility

Individual responsibility for contribution to the

team’s goals

Appropriate use of social skills

Characteristics of Ineffective Teams

Ineffective teams share certain problems, including:

Lack of commitment to common objectives

Objectives that are not meaningful to members

Members who do not discuss team processes

Unclear goals

Undefined roles and responsibilities for the team

members

Overbearing or dominating members

Disagreements among members that are not dealt

with effectively

Members who do not carry their weight

Feuding members

Accepting opinions as fact and without question

Moving too quickly



©2012 29

NOTES Four Developmental Stages of Teams

Individuals working together toward a shared goal tend

to move through four phases:

Forming

Storming

Norming

Performing

FORMING

In this stage, the team members get together for the

first time. At this point, the team’s dynamics,

values, and traits are undefined, and the team

members are uncertain of their roles and

responsibilities.

During this stage, the members assess each other

and identify how they fit into the group.

During formation, team members disagree on the

team’s objectives, allowing the group to work

together to define the team’s purpose, identify its

goals, and establish ground rules for how members

should work together.

STORMING

In the storming stage, the members begin to push

their own point of view and conflict arises as

individuals begin to struggle with their differences.

To be effective, the members must work through

their conflict in a way that fosters creativity. They

must deal with their differences and employ a

strategy for productive conflict resolution. This

stage tests the loyalty of the members to the team’s

goals. A team that does not resolve conflicts among

its members will not reach its potential.



©2012 30

NOTES NORMING

In the norming stage, the team members accept and

appreciate the differences among themselves and

begin to trust each other. This drives the group to

develop a stronger commitment to the team’s goals.

PERFORMING

In this stage, the members become a productive and

effective team. During this stage, team members

trust each other and the group progresses toward a

shared vision.

PROJECT MANAGEMENT AND THE FRAUD EXAMINATION


©2012 31

NOTES Introduction

As with most large projects, the success of a fraud

examination is often made or broken by how it is managed.

Successfully managing an investigation involves navigating

many challenges, such as breaking down the boundaries

between departments and developing goals that each team

member can accept. This section addresses these issues and

more, focusing on ways to manage fraud examinations

conducted by teams. Specifically, it explains:

Outlining the investigative course of action

Identifying phases, tasks, and checkpoints

Planning the investigation effectively

Managing the investigation team

Monitoring the progress of the investigation

Balancing conflicting resources and demands for time

Outlining the Course of Action

Before beginning a fraud examination, the team members

should gain a basic understanding of the central issues of

the case and outline the course of action they expect to

take.

The following is a list of questions the team will typically

want answered before beginning a fraud examination:

What is the time frame?

What is the nature of the suspected fraud?

Where are the relevant locations?

Who is the contact at the locations?

Who are the targets?

Does the issue predate any of the key players?

Are there deadlines and, if so, what are they?

Are there any reporting requirements?

Have any related fraud examinations ever been

conducted at this location?

What other entities might be involved?

What other sites might be involved?



©2012 32

NOTES Does management perform background checks on

employees as a precondition of employment?

Did the suspected fraud occur in an industry or location

that has a history or culture of fraud?

Has the organization been in compliance with reporting

and regulatory requirements?

What is the profitability of the unit or organization at

issue in the investigation?

Does the organization’s level of growth make sense in

light of its industry and peers?

Has there been a recent acquisition and, if so, is former

management still in place?

Does the organization have a fraud policy?

What type of report, written or oral, does the client

expect?

What is the budget?

Among other things, the course of action should identify

the information necessary to complete the investigation and

include the investigative activities to be performed. For

example, the outline should include items such as:

Who will be interviewed and when?

What documents will be requested?

If the team is to prepare a report of the investigation,

what form should the report take and when should it be

completed?

The procedures performed during an investigation will vary

from case to case, and they can include a number of

different measures. The actual procedures performed might

include, but are not limited to, the following measures:

Obtain any available records of the allegations, such as

the hotline report, anonymous letter, and so forth.

If the incident was reported, interview the person who

made the report if his identity is known and if he is

willing to be interviewed. (Note that in all cases, it is



©2012 33

NOTES important to safeguard the whistleblower’s identity and

any information concerning the whistleblower.)

Determine what documents and data are critical to the

examination and any potential subsequent investigation,

and take measures to safeguard and secure the

information.

Gather supporting documentation related to the

suspicious activity. This can include disbursement

records, travel records, meeting minutes, and so on.

Identify employees or third parties who might have

information and conduct fact-finding interviews.

Summarize the findings and meet with counsel and the

appropriate individuals to determine what subsequent

steps, if any, are required.

Moreover, during the course of the examination, the

circumstances will change and new information will

emerge; therefore, the team and management should

continuously refine and modify the plan throughout the

investigation.

Identifying Phases, Tasks, and Checkpoints

Fraud investigations are best managed as a series of

structured phases, providing a coherent flow for execution

and allowing for review and ongoing reflection. And once

the team completes a phase, it should be marked as a

milestone.

Generally, a fraud examination will include the following

five phases:

Conduct a preliminary assessment.

Form the investigative team and assign responsibilities.

Plan the investigation.

Conduct the investigation.

Prepare a report on the investigation.



©2012 34

NOTES For a fraud examination to allow for review and ongoing

reflection, each phase of the investigation should include

defined tasks and checkpoints to provide a foundation for

analysis and evaluation, allowing the team to determine

whether the investigation is going as planned.

Each of the five phases of a fraud examination can be

broken down into tasks and checkpoints. Like goals, tasks

and checkpoints are necessary to provide focus and

direction; they also provide the team with benchmarks for

determining whether they are succeeding. To provide

guidance and set benchmarks, tasks and checkpoints

should:

Be clear and specific so that each team member

understands exactly what is expected.

Contain measureable standards (e.g., dates, amounts,

etc.) that can be used to track progress and motivate

team members.

Be attainable.

Be challenging in a way that provides an opportunity

for the team to stretch their skills.

Be developed by and agreed upon by the team.

The list below demonstrates how a fraud examination can

be divided into phases and checkpoints:

Conduct a preliminary investigation:

Determine if fraud occurred.

Identify the status of the fraud.

Review any applicable policies and procedures.

Identify potential claims and offenses.

Form the investigative team and assign responsibilities.

Plan the investigation:

Determine the goals of the investigation.

Determine the scope of the investigation.

Establish a line of authority.

Allocate necessary resources.



©2012 35

NOTES Determine the need for law enforcement assistance.

Structure the investigation to preserve

confidentiality.

Select the best approach.

Outline the investigation.

Establish the time frame for the investigation.

Conduct the investigation:

Gather relevant documents (e.g., files, computer

files, memos, letters, emails, etc.).

Record and store information appropriately.

Manage documentary evidence.

Review documentary evidence.

Interview relevant individuals:

Identify who should be interviewed.

Identify who should interview the witnesses.

Determine when the witnesses should be

interviewed.

Determine where the witnesses should be

interviewed.

Determine how the witnesses should be

interviewed.

Record and store information appropriately.

Prepare a report on the investigation.

Once the team’s tasks and checkpoints are established,

identify the skills needed to complete them and delegate the

tasks based on the members’ skills and experience.

Once the tasks are assigned, team members must track their

progress to help leaders can provide assistance or resources

when needed. Additionally, having the documenting

progress is helpful when reviewing past performance.

Planning the Investigation

As noted above, successfully managing a fraud

examination involves giving deliberate attention to several



©2012 36

NOTES specific items during the planning phase before the

investigative work is commenced.

Defining the Goals of the Investigation

At the outset of the engagement, management should

consider and articulate the goal or purpose of the

investigation. In general, fraud investigations are

centered on finding evidence to prove fraud and recover

any losses. Consequently, the goal of most fraud

investigations will be to determine whether fraud

occurred and, if so, who perpetrated it.

Once the goals are defined, the examination can be

designed to uncover evidence that will answer these

questions. Generally, a fraud investigation should be

designed to:

Prevent further loss or exposure to risk.

Determine if there is any ongoing conduct of

concern.

Establish and secure evidence necessary for

criminal or disciplinary action.

Minimize and recover losses.

Review the reasons for the incident, investigate the

measures taken to prevent a recurrence, and

determine action needed to strengthen future

responses to fraud.

Help promote an anti-fraud culture by making it

clear to employees and others that the organization

will pursue all cases vigorously, taking appropriate

legal or disciplinary action where it is justified.

Protect the company’s legal privileges.

Determining the Scope of the Investigation

Management must determine the scope of the

investigation. For example, it might be limited to the

subject matter or the geographic area at issue. The



©2012 37

NOTES scope will depend on a number of factors, and

management should use the following guidelines to

help determine the scope:

Develop a list of key issues raised in the initial

assessment.

Consider the quality of the organization’s anti-fraud

program and policies.

Consider the organization’s actual culture of

compliance.

Consider the risk profile of the department from

which the suspicions stem.

Examine the nature of the suspected misconduct.

Identify how many people or business units are

involved in the suspected conduct.

Determine the extent to which mid- and senior-level

management is involved in the suspected

misconduct.

Determine whether the issue is widespread or

isolated to a particular area.

Consider what the government expects.

Determine the period of time over which the

suspected misconduct occurred.

Ascertain whether the suspected misconduct was

prohibited by the company’s anti-fraud program.

Consider broadening the scope of the investigation

if the allegations indicate a failure in the company’s

anti-fraud program.

Decide whether a civil or criminal suit is likely.

Determine whether the issue is likely to result in

adverse publicity.

To determine the scope, management should also

consider how the issue became known (i.e., what

prompted the investigation). Fraud issues can arise from

a number of different sources, which will prompt

different responses. If, for example, the issue came to



©2012 38

NOTES light during a government investigation, the company’s

examination should shadow the government’s actions.

Some common sources of allegations include:

Concerns from the board of directors, executives, or

management

Whistleblower allegations from known and

anonymous sources

Internal audit findings or concerns

Complaints from vendors, contractors, sub-

contractors, and so on

Competitor complaints

Regulator inquiry

Government investigators

Foreign government or officials

Media sources (newspapers, journalists, etc.)

Prospective purchasers

Establishing a Line of Authority

If the organization does not have a pre-established line

of authority in its fraud policy or investigative

protocols, management should define the team’s

authority levels, responsibilities for action, and

reporting lines for suspected or alleged violations

during the planning process. Management should define

the line of authority to avoid conflicts from competing

interests between departments and team members.

Planning for Document Collection

Documents provide the foundation of the case on which

the examiner will build the structure of the

investigation. Documents can be evidence in

establishing that a fraud was committed, in determining

the nature and scope of the fraud, or in identifying the

parties responsible.



©2012 39

NOTES To conduct a successful investigation, the fraud

examiner must know what to look for and where to look

for it. Often, it is necessary to meet with a member of

the organization to discuss the types of evidence that

might be required and to locate that evidence.

The team should consider developing a plan for the

collection of documents to focus efforts on material

most likely to be relevant and avoid collecting an

excessively broad amount of documents.

Additionally, the geographic location of data should be

considered. Outside the United States, many countries

have enacted data privacy laws and regulations that

might affect a global investigation.

To develop a document collection plan, the team

should:

Identify the types of documents that can help the

fraud examination.

Make a list of potential sources of relevant

information (e.g., file cabinets, suspect’s office,

personnel department, accounting department, third-

party sources, etc.).

Determine how and if the documents should be

collected.

Identify who will collect the information.

Identify areas that need to be processed

immediately and prioritize the collection of

documents.

Determine when the data should be collected and

where it will be stored after collection.

When requesting, obtaining, and maintaining

documents for a fraud examination, the team should

address a number of other considerations, including:



©2012 40

NOTES Are there any internal reports (e.g., audit,

compliance, security, legal, due diligence, risk

management, ethics, etc.) available for review?

Is employee email available for review?

Are there computer resources (e.g., laptops,

desktops, etc.) that need to be secured?

Where are the digital records stored?

What types of public records would be helpful to

the fraud examination?

Are there any documents held by third parties that

might be useful?

Planning for Interviews

As with all other phases of a fraud investigation, an

interview will be most successful if the interviewer is

thoroughly prepared. To be prepared, the interviewer

should have a clear idea of what information he wants

to obtain and what information the subject should be

able to provide, and he should have a game plan for

how to obtain that information.

Here is a list of questions that should be addressed

when planning for interviews:

What are the matters or issues that are important to

the interview?

What is the objective of the interview?

What are the legal or administrative requirements

that the interview will seek to support?

What evidence or information will be sought during

the interview?

What documentation should be gathered to support

the interview?

If an allegation has been made, what documentation

is necessary to support or refute the allegation?

What interview approach is likely to be the most

effective?



©2012 41

NOTES Who will be present during the interview?

Who will participate in the interview?

Who will lead the interview?

Where will the interview take place?

When will the interview take place?

How long will the interview take and will there be

enough time?

Will the interview be recorded and, if so, how?

What is likely to happen after the interview?

Determining the Need for Law Enforcement

Assistance

The planning stage of the investigation should also

include considering the need for law enforcement

assistance. That is, management must decide if the issue

is serious enough to call in the police or other law

enforcement entities. Whether to seek assistance from

law enforcement can be a difficult decision for

companies to make.

If, at the beginning of the investigation, management

determines that it will make a formal referral to law

enforcement or a prosecuting agency, then it must

notify the authorities before the investigation

commences to determine whether law enforcement

personnel should participate in the examination.

Other Planning Considerations

Throughout the planning process, management should

consider three key factors:

The governing laws on fraud

The locations of company data

Laws that will affect obtaining data and reviewing

documents



©2012 42

NOTES Dealing with Underperforming Team Members

The anti-fraud profession is full of hardworking, dedicated

individuals putting in far more hours than what is required

of them, but, like all professions, it has members who

underperform.

Underperforming team members are individuals who have

a detrimental effect on the team’s productivity, morale, or

deliverables, and these individuals put the investigation’s

success at risk. And in the anti-fraud profession, where

demands are high and budgets are tight, even one

underperforming team member can put pressure on an

investigation. Therefore, team leaders must deal with

underperforming team members to promote healthy team

dynamics. Even high-performing, valued members of a

team can be toxic to other team members and the team’s

work.

To understand why members underperform, it is necessary

to examine performance.

Four Parts of Performance

An individual’s performance comprises four parts:

Skills: This refers to a member’s capability for

doing his job.

Motivation: This refers to the member’s desire to do

his job.

Alignment: This refers to the member’s

understanding of the team’s goals and directions

and of his role in meeting them. Thus, leaders must

communicate expectations to team members in an

open and clear manner.

Structure: This refers to the team’s organization. A

team must be organized in a way that allows all

members to perform their work.



©2012 43

NOTES The Causes of Underperformance

Underperformance can have various causes and the

appropriate response to it will differ based on the cause.

Thus, team leaders must be able to identify the reason

for performance issues to know how to properly

respond.

Below is a list of causes for a team member’s

underperformance:

Lack of skills: A member might underperform

because he lacks the ability to do his job.

Lack of motivation: If a team member is not

motivated, he will not perform. Often, poor

relationships among team members can affect

motivation for performance. For example, if a team

member feels ostracized or underappreciated, these

feelings will affect their work.

Lack of alignment: If a member does not understand

what goals the team needs to meet, he will fail at his

role. Often, team members who are unclear about

their roles will fail to do things or do things that are

unnecessary.

Poor team structure: If a team is not organized in a

way that allows each member to perform their

work, they are bound to fail because the system has

set them up for failure.

Five-Step Process for Dealing with

Underperformance

Here is a five-step process for dealing with

underperforming team members.

STEP 1: IDENTIFY THE PROBLEM

The first step to dealing with underperformance is

to determine what is causing it. To do this, analyze

the reasonableness of the team member’s role and



©2012 44

NOTES responsibilities. Are they realistic? Does the

individual have the resources to do the job

effectively? Is it a personal issue?

STEP 2: COMMUNICATE THE PROBLEM

Once the problem has been identified, the leader

should communicate the issues with the

underperforming person. Leaders should not be

reluctant to address concerns; they should be ready

to address issues as they occur. Communication is

important because it provides an opportunity for

discussion and feedback.

When communicating the problem to the team

member, the leader should convey it in a positive

light (i.e., seek to convince the team member that

this is an opportunity for them to grow). More

specifically, the leader should:

Explain the expectations he has for the team

member.

Tell the member how valuable he is to the team

(i.e., what he contributes).

Explain the team member’ deficiencies and that

they are overshadowing the member’s value and

weakening the team’s dynamics. (Explain how

the team member is affecting the team’s work.)

Make an assertion about what the team needs

without being threatening (i.e., explain to the

individual how he should perform in the future).

STEP 3: CREATE PERFORMANCE GOALS AND

MEASUREABLE OBJECTIVES

Once the problem has been communicated, the team

leader should create a performance plan for the

member. The plan should be designed to

communicate to the team member the specific areas



©2012 45

NOTES that do not meet expected standards and should do

the following:

State the expected level of performance

improvement.

Set objective goals.

Give the member a timeline for corrective

action.

Give explicit consequences for failure to meet

the objectives.

STEP 4: MONITOR THE TEAM MEMBER’S

PROGRESS

Once the performance goals and measureable

objectives are set, the leader should monitor the

member’s progress and conduct periodic reviews to

provide constructive feedback.

STEP FIVE: FOLLOW THROUGH WITH THE PLAN

At the end of the stated period, the leader must

determine if the team member met his assigned

objectives. If not, the leader must follow through on

the stated consequences.

Things to Avoid When Dealing with Underperforming

Team Members

Below is a list of things to avoid when dealing with

underperforming team members:

Do not ignore underperforming team members

because doing so will cause dysfunction in the team

and can affect both morale and the leader’s

credibility.

Do not get rid underperforming team members who

add value to the team.

Do not pass underperforming team members on to

something or someone else (e.g., putting the

member on a special project or transferring them to



©2012 46

NOTES another team). This will not correct the problem.

What’s more, passing the problem will send a

message to the team that underperforming members

will receive special treatment.

Do not make quick judgments or jump to

conclusions. Avoid labeling team members because

doing so will affect your ability to view the

situation objectively, and it will prevent any

constructive discussion.

Measures to Help Avoid Underperformance

Below is a list of measures for avoiding

underperformance:

At the beginning of the investigation, set goals and

outline expectations for each team member so they

know what they have to achieve. When all goals are

communicated openly, the probability that a team

member will fail to meet them is reduced. Goals

should be based on each member’s skills and

abilities.

Give ownership of a specific task or area to each

team member and require that they report on the

progress of the task. This will give each team

member responsibility for something.

Provide rewards and recognition to team members

who meet their goals.

Motivate team members by offering them

challenging roles.

Keeping Your Team Informed and on Task

Team members need to know the essential information

about the investigation. Otherwise, they might lose interest

in it, lose respect for the team’s ability to conduct a

thorough examination, or veer off track. It is the leader’s

responsibility to keep the team informed and on task.



©2012 47

NOTES This discussion examines some reasons why teams get off

task and how to ensure that the team stays informed and on

track.

Reasons Teams Get off Task

Here is a non-exhaustive list of reasons teams get off

track:

Individuals are confused about the investigation’s

goals and scope.

The planning is poor.

Leaders do not provide a clear timeline.

Team members have different goals and competing

priorities.

Members have personal agendas that impede

progress.

Individuals do not trust each other.

Team members work in isolation rather than

together.

Tips to Ensure That the Team Stays Informed and on

Task

Below is a list of ways to ensure that the team stays

informed and on track:

Set and communicate team goals.

Involve team members.

Document the investigation plan.

Evaluate the team’s process.

Keep the team members informed.

Consider assigning different tasks and

responsibilities to team members.

Set the correct tone.

SET AND COMMUNICATE TEAM GOALS

As mentioned, management must set goals for the

investigation at the outset. This will give the team

purpose, and it will give them checkpoints for



©2012 48

NOTES measuring success. Additionally, every team

member must be clear about the investigation’s

goals.

INVOLVE TEAM MEMBERS

Team members want to be involved in the

development and progress of the investigation and

they frequently have insightful ideas that can

improve the work.

DOCUMENT THE INVESTIGATION PLAN

The plan should provide a roadmap for the

investigation and include things such as timelines

and outlines. It should identify the investigation’s

primary goals and be concise and easy to read. The

plan should also outline the action required to

accomplish the stated goals.

EVALUATE THE TEAM’S PROCESS

Keeping the team on task requires assessing

processes and analyzing what worked and what did

not.

KEEP THE TEAM MEMBERS INFORMED

Communications are critical to a successful

investigation. Team members want regular updates

on the progress of the investigation and their

personal performance.

Use emails, memos, phones, group meetings, and

one-on-one meetings to keep team members

informed. Tell them about any current challenges,

and give them feedback on their performance. Also,

everyone should be made aware of new decisions,

steps taken, changes in plans, or other details that

are vital to the investigation.



©2012 49

NOTES Even if a team member is not involved in each

aspect of the investigation, every team member

should be knowledgeable about the investigation’s

details.

CONSIDER ASSIGNING DIFFERENT TASKS AND

RESPONSIBILITIES TO TEAM MEMBERS

If the team agrees, assigning different segments of

the investigation to different team members can

help organize the examination. For example, one

member could be in charge of communications,

another could be in charge of scheduling meetings,

and so on.

SET THE CORRECT TONE

If a team leader wants his team to be successful, he

must set the correct tone.

Monitoring the Progress of the Investigation

During the course of an investigation, it is important to

monitor the team’s progress. Often, the team leader will

monitor the progress, but the team can appoint a monitor to

oversee the team’s work. The monitor should be qualified,

trained, and experienced to track the investigation’s

progress.

In general, the monitoring process should include:

Conducting an ongoing review of whether the manner

of investigation is appropriate

Comparing the investigation’s progress to the plan and

altering the plan when needed

Maintaining the proper chain of the evidence

Consulting with team members regularly on their

progress in both informal sessions and scheduled

reviews



©2012 50

NOTES Tracking key tasks, deadlines, and timelines

Monitoring the use of experts to ensure they are used in

a cost-effective way

A team leader might consider using a case management

software program. These programs can help manage data

and information gathered during the investigation, and they

can create reports, graphs, and charts of a particular case.

Balancing Conflicting Resources and Demands for Time

Individual team members will often face competing

demands for resources and time that can affect their ability

to perform their roles effectively.

To avoid such conflicts, seek to:

Agree, at the outset, on the period during which the

team will operate.

Agree, at the outset, about how much time team

members should spend in their roles.

Fill the team member’s regular job responsibilities if

the examination and other jobs will require more than is

reasonably available.

Reward the team’s results separately from the

individual members’ job performances.

ABOUT THE ASSOCIATION OF CERTIFIED FRAUD EXAMINERS

©2012

About the ACFE The Association of Certified Fraud Examiners (ACFE) is the world’s largest anti-fraud organization and premier provider of anti-fraud training and education. Together with more than 60,000 members, the ACFE is reducing business fraud worldwide and inspiring public confidence in the integrity and objectivity within the profession. Founded in 1988 by Dr. Joseph T. Wells, CFE, CPA, and former Federal Bureau of Investigation (FBI) Special Agent, the ACFE has become the largest anti-fraud organization in the world. ACFE members in more than 160 countries have investigated more than two million cases of suspected criminal and civil fraud. Members of the ACFE include CPAs; auditors; lawyers; investigators; law enforcement officers; security professionals; executives; managers; and anyone whose job involves preventing, detecting, or deterring fraud. The ACFE supports members and the anti-fraud profession by providing conferences, seminars, and other training events year-round, while also offering self-study and online learning opportunities, manuals, software, and other resources for fighting fraud. By becoming an ACFE member, you will receive many valuable benefits that help to promote your professional and career development. These benefits include access to members-only services and resources, as well as discounts on many of the ACFE’s valuable products. To learn more about becoming a member of the ACFE, visit our website at www.ACFE.com/Membership or call (800) 245-3321 (USA & Canada only) or +1 (512) 478-9000. A Leader in Research The ACFE supports the future of fraud examination by providing funding and resources through its Anti-Fraud Education Partnership and Law Enforcement Partnership. ACFE research, including the Report to the Nations on Occupational Fraud & Abuse, provides benchmarking statistics on fraud, and the ACFE is one of the founding members of the nonprofit Institute for Fraud Prevention (IFP). The IFP is a consortium of domestic and international universities dedicated to cutting-edge research into the causational factors of a wide variety of white-collar crimes. Certified Fraud Examiners (CFEs) The ACFE established and administers the Certified Fraud Examiner (CFE) credential. Globally preferred by employers, the Certified Fraud Examiner credential denotes proven expertise in fraud

ABOUT THE ASSOCIATION OF CERTIFIED FRAUD EXAMINERS

©2012

prevention, detection, deterrence, and investigation. Members with the CFE credential gain a professional advantage and quickly position themselves as leaders in the global anti-fraud community. CFEs are knowledgeable in four major areas critical to the fight against fraud: • Fraudulent Financial Transactions • Fraud Prevention and Deterrence • Legal Elements of Fraud • Fraud Investigation To become a CFE, one must: • Pass a rigorous examination administered by the Association of Certified Fraud Examiners (ACFE). • Meet specific education and professional requirements. • Be approved by the ACFE certification committee. • Exemplify the highest moral and ethical standards and agree to abide by the bylaws of the ACFE

and the CFE Code of Professional Ethics. • Maintain annual CPE requirements and remain an ACFE member in good standing.

To learn more about becoming a Certified Fraud Examiner, visit our website at: www.ACFE.com/CFE.

As experts in the four major areas of fraud, CFEs are trained to see the warning signs and red flags that indicate not just actual fraud, but fraud risk―potentially saving organizations thousands of dollars in losses through prevention and detection before it’s too late. CFEs have the ability to: • Identify an organization’s vulnerability to fraud. • Examine data and records to detect and trace fraudulent transactions. • Interview personnel to obtain information. • Write fraud examination reports, advise clients about findings, and testify at trial. • Advise on improving fraud prevention and deterrence measures. Learn more For more information about the ACFE, visit our website at: www.ACFE.com.