employee fraud: detection, investigation and response acfe – toronto chapter march 5, 2013

Denise L. Bambrough - Fraud Law [email protected]

Elissa Sinha – Fraud Law [email protected]

www.blg.comTwitter: @BLGLaw

Employee Fraud:Detection, Investigation and Response

ACFE – Toronto ChapterMarch 5, 2013

Agenda

• Identifying employee fraud

• Why the conduct of an employee fraud investigation is so important

• Investigating allegations of employee fraud

• Meeting with the suspect employee

• Mitigation and recovery of damages

2

What is Fraud?

“[a] generic term embracing all multifarious means which human ingenuity can devise, and which are resorted to by one individual to get advantage over another by false suggestions or by suppression of truth, and includes all surprise, trick, cunning, dissembling, and any unfair way by which another is cheated.”

Black's Law Dictionary, 6th ed., s.v. “Fraud”

3

Identifying Employee Fraud

• When does fraud occur?

• Motive

• Opportunity

• Rationalization

• Most fraudsters are influenced by a combination of opportunity, quantum at issue and risk of detection

4

Identifying Employee Fraud

Method of Detection of Fraud Percentage of Cases Discovered

Tip 43.3 Management Review 14.6 Internal Audit 14.4 By Accident 7.0 Account Reconciliation 4.8 Document Examination 4.1 External Audit 3.3 Notified by Police 3.0 Surveillance/Monitoring 1.9 Confession 1.5 IT Controls 1.1 Other 1.1

5

“Report to the Nations on Occupational Fraud and Abuse – 2012 Global Fraud Study” Associationof Certified Fraud Examiners

Common Employee Fraud Schemes

• Embezzlement

• Fictitious vendor/invoice schemes

• Secret commissions and kickbacks

• Expense report fraud

• Financial statement fraud

• Payroll fraud – phantom employees

• Cheque fraud

• Inventory and asset misappropriation

6

Employee Fraud – Red Flags

• Be alert to changes in the behaviour, attitudes and lifestyles of employees

• Possible red flags include:

• Living beyond apparent means

• Financial difficulties

• Unusually close association with vendors or customers

• Severe stress

• Alcohol or drug abuse

• Gambling

• Extreme nervousness

• Dissatisfaction with salary or position

7

Employee Fraud – Red Flags (continued)

• Reluctant to take vacations or be absent for any reason

• Works significant amounts of overtime, without seeking compensation

• Offers gifts to encourage others to turn a blind eye

• Excessively angry, defensive or forgetful when asked about business processes, procedures and decisions

• Lies about business-related matters

• Expense account is heavily used in comparison to employees with similar responsibilities

8

Why The Conduct of An Employee Fraud Investigation is so Important

• Defrauding one’s employer is just cause for dismissal

• However, where theft or other fraudulent conduct is the reason for dismissal, a more exacting standard of proof is imposed upon the employer

• Meeting this standard requires a “fair and diligent” investigation of the alleged conduct

9

Why The Conduct Of An Employee Fraud Investigation Is So Important

• Even the most serious and seemingly obvious cases of employee fraud must be investigated with great care, an open mind and fairness to the suspect employee

• An incompetent investigation may:

• Fail to establish fraud as just cause for dismissal

• Expose the employer to possible claims for:

• Wrongful dismissal • Defamation• Constructive dismissal • Infliction of mental distress• Conspiracy to injure • Punitive damages

10

Investigating Allegations of Employee Fraud

• Always keep an open mind• The only one who knows all of the facts is the

fraudster and there may be more than one• False accusations can be costly!

• Secure and preserve the evidence• Be discreet

• Reputations are at risk

• Consult experts – lawyers, accountants, computer forensics experts, private investigators at an early stage

11


• Protect against further loss

• Identify all security concerns with respect to the suspect employee(s), including:

• keys to premises• pass cards to premises• passwords to network system• voice mail• e-mail• data stored on laptops

12


• data stored on home computers

• data stored on mobile devices

• files or records at employee’s home office

• access rights from external computers

• banking arrangements

• dealings with outside suppliers

• and any other source of vulnerability between the suspect employee(s) and the company

13

Meeting with Suspect Employee

• Rights of the parties:• An employer has the right to conduct an interview• An employee does not have the right to refuse an

interview• No right to counsel• No right against self-incrimination• Caution - R. v. Reid - [2000] N.J. No. 210

(Nfld.S.C.T.D.)

14

Pre-Meeting Preparation

• Secure personnel file of suspect employee(s)• Secure company documents relevant to the investigation• Secure/image computers and electronic records, if policy

clearly provides for same.• Ensure that the investigation is conducted on a “need to

know” basis involving only those senior management persons with information concerning the investigation

• If the employee is a member of a union, review the collective agreement for any rights or requirement to have a union representative in attendance at the meeting*15


• Be prepared – know all of the facts; know how the system works

• Organize all relevant documents for interview of suspect employee(s)

• Prepare outline of known facts for review with suspect employee(s)

• Consider potential reaction of employee(s) (both employee under investigation and other staff) and determine whether counseling for employee(s) should be offered

16


• Consider whether the suspected employee fraud triggers fidelity insurance coverage or a duty to give notice to fidelity insurer or regulatory authorities and, if so, take appropriate steps to give notice*

• Consider taking preliminary steps such as commencing legal proceedings to secure any employee or third party assets prior to confronting employee(s)*

17

Employer’s Right to Investigate vs. Employee’s Right to Privacy

• Many workplace investigations give rise to issues involving the respective rights of the employer and the employee relating to the use of workplace technology

• An employer has a legitimate interest in the conduct and activities of its employees in the workplace

• Employees, on the other hand, have certain rights of privacy

• These interests have to be balanced

18


• Distinction between test for exclusion of evidence in criminal cases vs. civil cases

• Canadian Charter of Rights and Freedoms values may guide judiciary in civil cases

• The Ontario Court of Appeal has recently recognized a common law tort of invasion of privacy or “intrusion upon seclusion”

• Recent Court decisions highlight the need for clear policies

19


• Ensure that you have clear and unambiguous information technology and privacy policies with respect to personal use and storage of information on work computers

• Stipulate that the hardware and all information thereupon belong to the employer and can be accessed and verified at all times

• Ensure that the policy is known and enforced

• Notify employees that information obtained during monitoring may be turned over to the police if the commission of a crime is suspected

20

• Case acknowledges that employers may access data stored by employees on workplace computers, in appropriate circumstances

• Before conducting a thorough search of an employee’s computer, ensure that there are serious reasons (supported by evidence) to do so

• Police authorities need a warrant to access such information, even if the employer is entitled to access it

• Verify with counsel before searching an employee’s computer, regardless of the circumstances

21



• Identify Interview team:• Person in charge of investigation• Senior management with responsibility for human

resources• Union representative, if necessary or appropriate• Outside counsel or other consultants• Someone neutral to be a witness and take notes

22


• Decide who, where, when, with how much notice and for how long

• Consider order of interviews to be conducted• Always conduct the interview in person• Interview as soon as practicable• Provide as little advance notice as possible• Assume that the first meeting will be the only meeting

23


• Conduct interview impartially and with an open mind• Request the employee’s explanation• Challenge the employee’s explanation using

documents• Record verbatim legible notes• Include initial “chitchat”, observations, comments,

long silences, description of body language• Tape record meeting only with knowledge and

consent*

24


• Allow the employee time to become comfortable before making any accusations (i.e. “I understand that you have a lot of expertise/knowledge of this issue. I hope you can help me.”)

• Maintain eye contact• Don’t let the suspect employee gain control of the

interview• Don’t accept vague answers

25


• Don’t disclose all of the information which has been obtained

• Don’t let the employee know where you are going with your questions

• Don’t over-complicate the interview• Move quickly through the facts• Obtain a confession and a signed statement, if possible

Have the employee review the notes/statement, initial every page and confirm accuracy

26


• Be fair:• Don’t treat different employees differently• If employee asks whether is subject of investigation,

don’t mislead, but don’t suggest that conclusion has been drawn already (i.e. “Right now, we are looking into all of the facts before we can determine who is responsible. We will be interviewing several other people as well.”)

27


• If further investigation is warranted following meeting with suspect employee, temporary steps should be taken to preclude further access to company facilities by suspect employee while investigation is underway, including request for keys, pass cards, passwords, and any other security concerns as referenced above*

• Consider whether appropriate to request that suspect employee access office computer and provide all passwords for access prior to departure*

28


• Consider whether appropriate to request hard drive dump of laptop or home computer and deletion of company files located on other computers*

• Inform employee of duty to assist with ongoing investigation and confidentiality of the investigation

• Consider whether appropriate to offer counseling to employee

• If further investigation is warranted, consider suspending the employee either with or without pay pending completion of investigation*

29

Interaction With the Police

• There is no legal obligation to report employee fraud to the police

• But, is there a policy of reporting all criminal offences to the police?

• An employer cannot offer to refrain from reporting fraud in exchange for restitution

• An employer cannot threaten criminal charges in the absence of restitution

30

Interaction With the Police

• An employer cannot simply rely upon criminal charges to justify discipline/dismissal

• An employer is often in a better position to investigate:

• Familiarity with employees• Familiarity with procedures• Employees/witnesses may be less intimidated and more

frank• Resources

• Control over investigation• Access to evidence• Access to witnesses

• Action for malicious prosecution

31

Post-Meeting Action

• Pursue any further investigation required, including interviewing additional employees, suppliers, customers and others who may have knowledge (Note: No allegations of dishonesty should be made about the employee at this stage)

• Develop a communication plan - consider retaining a public relations firm to assist

• Consider possible further interview of suspect employee prior to termination

32

Post-Meeting Action

• Consider what, if any, disciplinary proceedings should be pursued:• Explanation accepted and no further disciplinary

conduct warranted• Letter of warning• Written acknowledgement of wrongdoing by

suspect employee with commitment to avoid such future conduct

• Suspension with pay pending investigation*• Suspension without pay pending investigation*• Immediate dismissal

33

Post-Meeting Action

• If employee is to be terminated:• Prepare a termination letter with the assistance of

counsel• Prepare a “script” in advance of the termination

meeting• Take detailed notes of the meeting• Take appropriate steps to permit employee to recover

personal items and take inventory of work area• Draft internal announcement regarding the

termination with input from legal counsel

34

Post-Meeting Action

• Consider including arrangements for restitution in any termination agreement with employee

• Any restitution agreement should be premised upon a representation and warranty by the employee as to the scope of the fraud

• Obtain legal advice regarding the terms of any agreement, including any effect such an agreement may have on fidelity coverage

35

Post-Meeting Action

• If decision is made not to terminate, seek legal advice regarding fidelity insurance coverage and issue of possible automatic termination of coverage for “dishonest employee”

36

Post-Meeting Action

• If appropriate, consider terminating cheque signing authority and notifying suppliers and customers of termination

• Consider conducting a review of company systems, including hiring, supervision, accounting, Internet access, banking, etc. to address possible shortcomings and prevent further similar losses

• Consider purchasing fidelity insurance for coverage against future losses

• Consider implementation of or improvements to Employee Fraud/Dishonesty Policy

37

Post-Meeting Action

• Consider initiating legal proceedings against employee(s) and/or others for recovery of loss

• Consider possibility of any extraordinary remedies which may be available:• Mareva Injunction• Anton Piller Order• Norwich Pharmacal Order

38

The Mareva Injunction

• A Court Order which prevents a defendant from dissipating his or her assets prior to trial, including:• bank accounts• investment accounts• real property• motor vehicles• shares• offshore assets• other assets held directly or indirectly by the

defendant

39

Ancillary Relief

• Sworn affidavit as to assets (Disclosure Order)

• Production of information and documentation in the

possession of financial institutions

• Production of documentation in the possession of the

police

• Restitution Order

40

Sources of Information

• Police investigation

• Information to Obtain Search Warrant

• Access to Information Requests

• Private investigators

• Forensic accountants

• Financial institutions

• Other experts

41

Recovery Targets

• Defaulter(s)

• Co-conspirators and other parties to the fraud

• Constructive trustees

• Auditors

• Financial institutions

42

The Anton Piller Order

• Another pre-trial remedy

• Obtained without notice to the defendant

• Requires the defendant to grant the plaintiff’s

representatives access to its premises for the

purpose of searching for and preserving evidence of

a specified class

43

The Norwich Pharmacal Order

• An Order of the Court directed at third parties, which

requires them to disclose information and

documentation so that the plaintiff may:

• obtain information which is necessary to identify wrongdoers

• find and preserve evidence which may substantiate or

support an action against either known or unknown

wrongdoers, or even determine whether a cause of action

exists

• trace and preserve assets

44

Strategy for Recovery Steps

• Consult experienced counsel at an early stage

• Action plan

• Importance of acting quickly

• Preserve element of surprise

• Cost/benefit analysis

• Remedies can be cost-effective

45

THANK YOU!

5123351v1

employee fraud: detection, investigation and response acfe – toronto chapter march 5, 2013

Documents