1. society
2. crime
3. property crime
4. fraud

ACFE Course Materials
Welcome!
The ACFE would like to welcome you to Conducting Internal Investigations: Planning and
Logistics. We hope you will find this course informative and immediately useful. The materials in this
book will not only supplement your learning experience during the class, but will also serve as a
reference and reminder for you when you are back on the job.
There are a few important administrative items to keep in mind:
• Timing and Structure — Class will start promptly at 1:00 p.m. and end at 5:00 p.m. each day.
Beverages, continental breakfast, and one group lunch will be provided.
• Sign-In Sheet — Please initial next to your name on the Sign-In Sheet. It is critical that you
do so each morning to be eligible for CPE credit.
• Certificate of Attendance — Please complete the CPE Reporting Form found inside your
registration packet. This form is due on the last day of the seminar and will serve as your
Certificate of Attendance. Return the top white copy to the Registration Desk and keep the
bottom yellow copy for your records. The yellow copy will serve as your Certificate of
Attendance.
• Evaluations — Course evaluations will be distributed by email. Please take time to provide
feedback about the course, venue, and instructor. Your evaluation will help the ACFE make
improvements to future training courses. At the conclusion of the evaluation you will receive a
link to all the PowerPoint slides used throughout the class.
Thank you for attending. Please let us know if there is anything we can do to make your experience
in this class more comfortable, productive, and valuable.
Conducting Internal Investigations:
Planning and Logistics
©2012 by the Association of Certified Fraud Examiners, Inc.
Revised 5/21/12
No portion of this work may be reproduced or transmitted in any form or by any means
electronic or mechanical, including photocopying, recording, or by any information
storage and retrieval system without the written permission of the Association of Certified
Fraud Examiners, Inc.
“Association of Certified Fraud Examiners,” “Certified Fraud Examiner,” “CFE,”
“ACFE,” “Fraud Magazine,” “CFE Exam Prep Course,” “EthicsLine,” the ACFE Seal,
and the ACFE Logo are trademarks owned by the Association of Certified Fraud
Examiners, Inc.
WORLD HEADQUARTERS, THE GREGOR BUILDING
716 WEST AVENUE  AUSTIN, TX 78701-2727  USA
TEL: (800) 245-3321  +1 (512) 478-9000
FAX: +1 (512) 478-9297
WWW.ACFE.COM
DISCLAIMER
Every effort has been made to ensure that the contents of this publication are
accurate and free from error. However, it is possible that errors exist, both
typographical and in content. Therefore, the information provided herein
should be used only as a guide and not as the only source of reference.
The author, advisors, and publishers shall have neither liability nor
responsibility to any person or entity with respect to any loss, damage, or
injury caused or alleged to be caused directly or indirectly by any information
contained in or omitted from this publication.
Printed in the United States of America.
Association of Certified Fraud Examiners
23RD ANNUAL ACFE FRAUD
PRE-CONFERENCE
CONDUCTING INTERNAL INVESTIGATIONS:
PLANNING AND LOGISTICS
JUNE 17, 2012
ORLANDO, FL
11:00 a.m. – 1:00 p.m.
1:00 p.m.
2:10 p.m.
2:25 p.m.
3:35 p.m.
3:50 p.m.
–
–
–
–
–
2:10 p.m.
2:25 p.m.
3:35 p.m.
3:50 p.m.
5:00 p.m.
Registration: City Hall Lobby
Room Name: Sun Ballroom A
Responding to the Allegations: The First 24 Hours
Break
Building the Fraud Examination Team
Break
Project Management and Fraud Examinations
Leah Lane, CFE
Global Investigations Manager
Texas Instruments, Inc.
Leah Lane has more than 20 years of combined public and private sector investigations
and fraud examination experience. During her career, she has managed, worked, and assisted
in hundreds of investigations globally, involving allegations of Foreign Corrupt Practices Act
violations, internal and external fraud, and employee misconduct.
Leah is currently the Global Investigations Manager at Texas Instruments, Inc, where she
manages a group of investigators with global responsibility for investigations within TI. She
is also responsible for fraud awareness campaigns.
Before joining Texas Instruments, Leah served as the Audit Fraud Manager at jcpenney
and as a Security Manager for the Americas at HP/EDS. At these positions, she was
responsible for investigating and managing complex financial fraud and computer forensic
matters. She began her investigative career as a special agent in the U.S. Customs Service, a
position she held for more than seven years.
Leah is a Certified Fraud Examiner (CFE) and a Certified Fraud Specialist (CFS), and
holds a BS in Criminal Justice from the University of Southwestern Louisiana. She is an
active member of the Association of Certified Fraud Examiners, the Association of Certified
Fraud Specialists,and The Institute of Internal Auditors. Leah also serves on the ACFE
Advisory Council.
TABLE OF CONTENTS
PRACTICAL PROBLEMS
Practical Problems 1–3 ......................................................................................................... PP-1
RESPONDING TO THE ALLEGATIONS: THE FIRST 24 HOURS
Introduction ..................................................................................................................................1
What to Do When an Allegation of Fraud Arises ........................................................................1
Avoid Tipping Off the Fraudster .................................................................................................10
Identify the Investigation Leader .................................................................................................11
Contact the Complainant..............................................................................................................12
BUILDING THE FRAUD EXAMINATION TEAM
Introduction ..................................................................................................................................15
Structure the Investigation Team to Preserve Confidentiality .....................................................15
Identify What Skills Are Needed to Conduct the Investigation ...................................................18
Internal Versus External Expertise ...............................................................................................19
Select the Team ............................................................................................................................20
Do’s and Don’ts for Selecting Team Members ...........................................................................25
Allocate Necessary Resources .....................................................................................................26
Managing the Fraud Examination Team......................................................................................27
PROJECT MANAGEMENT AND FRAUD EXAMINATIONS
Introduction ..................................................................................................................................31
Outlining the Course of Action ....................................................................................................31
Identifying Phases, Tasks, and Checkpoints ................................................................................33
Planning the Investigation............................................................................................................35
Dealing with Underperforming Team Members..........................................................................42
Keeping Your Team Informed and on Task ................................................................................46
Monitoring the Progress of the Investigation...............................................................................49
Managing Conflicting Resources and Demands for Time ...........................................................50
©2012
Conducting Internal Investigations: Planning and Logistics
i
PRACTICAL PROBLEM 1
You are a CFE working for Obsidian Industries, a company that makes industrial-size fans.
Obsidian Industries receives a call through its fraud hotline stating that it should take a close look at
Steven Browning. The caller says Browning is giving favorable treatment to, and possibly receiving
favorable treatment from, Copius Copper, a vendor that sells copper wiring to Obsidian. The caller
says he has reason to believe that Browning is a part owner of Copius Copper. The caller does not
provide any other information.
Management at Obsidian Industries decides to conduct an initial assessment into the allegations to
determine if a formal investigation is needed and what steps, if any, are required to respond in an
appropriate manner.
Questions:
1. How should members of Obsidian’s management respond to the allegations? What initial
actions should the company take? What steps should the company take in evaluating these
allegations?
2. What are some key questions that the initial assessment should be designed to answer?
3. What can Obsidian Industries do to avoid tipping off culpable employees?
©2012
Conducting Internal Investigations: Planning and Logistics
PP-1
PRACTICAL PROBLEM 2
Wilson Aerospace is a publicly traded company. Over the weekend, someone called the company’s
hotline service and said, “Your CFO is cooking the books. Last quarter’s earnings were inflated.”
The caller refused to give his name or provide any further information.
The CFO is Richard Harris. He is the brother-in-law of the Wilson Aerospace’s CEO and founder,
Bruce Wilson.
After receiving the hotline tip, the management of Wilson Aerospace conducted an initial
assessment. The assessment uncovered additional facts that lent credibility to the whistleblower’s
allegations. Consequently, the company’s management decided to conduct a formal fraud
investigation into the potential for fraud within the financial reporting function.
The company’s legal counsel hires you, an outside fraud examiner, to conduct the fraud
examination.
©2012
Conducting Internal Investigations: Planning and Logistics
PP-3
PRACTICAL PROBLEM 2
Questions:
1. What kinds of skills are needed to complete the investigation?
2. Whom will you include on your investigative team?
3. Do you think that outside consultants will be necessary? If so, what types might you need?
4. What steps can you take at this stage to help protect the confidentiality of the investigation?
©2012
Conducting Internal Investigations: Planning and Logistics
PP-4
PRACTICAL PROBLEM 3
Refer to the facts of Practical Problem 1, which involved Obsidian Industries, and assume that the
company conducted an initial assessment that uncovered additional facts that lent credibility to the
whistleblower’s allegations. Specifically, Obsidian learned that Copius Copper is not on the
company’s approved vendor list, its address is a PO Box, and it is owned by two individuals, Roger
Smith and S. Jeremy Browning. Obsidian also learned that the whistleblower was Johnson, the
company’s accounts payable supervisor.
Accordingly, Obsidian’s management decides to conduct a formal fraud investigation into the
potential for fraud, and it assigns you the task of leading the investigation.
Based on these new facts, answer the following questions.
©2012
Conducting Internal Investigations: Planning and Logistics
PP-5
PRACTICAL PROBLEM 3
Questions:
1. Develop an investigative plan that outlines your course of action. Consider the goals, likely
procedures, deadlines, staffing needs, and period.
2. What legal problems, if any, do you anticipate as part of this fraud examination? What will you
do to avoid them?
3. Who are you planning to interview and in what order? How will you schedule the interviews
and where would you conduct them?
4. Where are the most likely places that you will find relevant evidence?
©2012
Conducting Internal Investigations: Planning and Logistics
PP-6
RESPONDING TO THE ALLEGATIONS: THE FIRST 24 HOURS
Introduction
When an allegation of misconduct arises, management
must respond in an appropriate and timely manner. And
during the initial response, time is critical. Therefore, fraud
examiners must be prepared to address a number of issues
in a short amount of time and sometimes under stressful
conditions.
This section explores the first steps that organizations and
fraud examiners should take when an allegation of fraud is
brought forward.
What to Do When an Allegation of Fraud Arises
Initially, when an allegation of fraud is arises, management
should respond quickly. The failure to act quickly against
suspicions of fraud could result in civil litigation, enhanced
penalties under the U.S. Sentencing Guidelines, and
enforcement actions by federal and state regulators.
Responding to an allegation of fraud, however, will vary
depending on the facts. The appropriate response will
depend on how the allegation came about (e.g., internal
sources, civil lawsuit, investigation by the government,
etc.).
Generally, when there is an allegation of fraud,
management will want the following questions answered:
 Does the alleged activity constitute fraud?
 Who is involved?






How should those who were involved in the fraud be
handled?
Are there any co-conspirators?
How much was lost to fraud?
During what period did the fraud occur?
How did the fraud occur?
How was the fraud identified?
©2012
Conducting Internal Investigations: Planning and Logistics
1
NOTES
RESPONDING TO THE ALLEGATIONS: THE FIRST 24 HOURS

Could the fraud have been detected earlier?
 What can be done to prevent similar frauds?
 Should the conduct be disclosed to the authorities?
To help answer these questions, management must act
swiftly. Specifically, it should take the following actions
when it receives an allegation of fraud:
 Engage legal counsel.
 Notify proper executives.
 Preserve relevant documents and electronic records.

Identify who should be involved in the matter.

Conduct an initial assessment to determine if an
investigation is needed and what steps, if any, are
required to respond in an appropriate manner.
 Stop the activity in question, if appropriate.
Engage Legal Counsel
Because fraud examinations are riddled with legal
uncertainties, management should consult with internal
and possibly external local legal counsel before making
any decisions or taking any action concerning the
suspected conduct.
Notify Proper Executives
If the preliminary investigation reveals that fraud has
occurred, management should notify proper executives
and, if appropriate, the entity’s board of directors.
Some companies have investigative protocols or ethics
and compliance responsibility matrices that define
exactly which executives should be notified about
specific types of events or violations. These forms
outline notification principles and escalation triggers
that vary depending on the nature and severity of the
allegations.
©2012
Conducting Internal Investigations: Planning and Logistics
2
NOTES
RESPONDING TO THE ALLEGATIONS: THE FIRST 24 HOURS
Example of Investigative Protocols
Preserve Relevant Documents
When evidence of fraud arises, management should
work with the Legal Department to issue a litigation
hold to ensure that all relevant documents, including
those stored electronically, are preserved. In a fraud
investigation, the term documents typically refers to,
but is not limited to, contracts, invoices,
correspondence, memoranda, weekly reports,
presentations, telephone messages, emails, reports,
performance reviews, performance improvement plans,
medical records, and any other written or recorded
material. A litigation hold refers to the steps a company
takes to notify employees to suspend the destruction of
potentially relevant records.
Litigation hold procedures are necessary to ensure that
potentially responsive documents are not destroyed
once evidence of misconduct arises.
The failure to preserve relevant evidence could have
several adverse consequences, including, but not
limited to, the government’s questioning of the integrity
of any fraud investigation, monetary fines and
©2012
Conducting Internal Investigations: Planning and Logistics
3
NOTES
RESPONDING TO THE ALLEGATIONS: THE FIRST 24 HOURS
sanctions, adverse inference jury instruction sanctions,
or dismissal of claims or defenses.
To develop litigation hold procedures, management
must examine how information moves through the
company, determine how to identify the materials
relevant to a particular issue, and develop a process that
ensures such information can and will be preserved.
Moreover, the procedures must be designed to ensure
that all documentary and electronic information that
potentially could be relevant to the investigation is
preserved.
Even though litigation holds should apply to both
electronic data and physical documents, electronic data
contains certain attributes that make executing a timely
litigation hold more difficult. Specifically, electronic
data might only be available for an evanescent time
period, business practices are often designed to free up
storage space by deleting this type of information,
electronic data can reside in numerous locations, and
identifying relevant electronic data within today’s large
and complex data systems can be challenging and
costly.
A key objective to any litigation hold is to ensure that
the company, or the individuals, stops any automatic
document deletion programs or rules that might be in
place for electronic records.
Moreover, if the company operates on an international
scale, there will be additional difficulties for executing
a timely litigation hold.
©2012
Conducting Internal Investigations: Planning and Logistics
4
NOTES
RESPONDING TO THE ALLEGATIONS: THE FIRST 24 HOURS
Therefore, management should consider retaining an
outside expert to assist in searching for and preserving
electronic data.
In general, the details of litigation hold policies should
be developed so the organization can:
 Promptly notify employees who might possess
relevant documents.
 Issue a preliminary hold order to all individuals and
employees who might possess relevant information
(i.e., custodians).






Promptly notify information technology (IT)
personnel and get their involvement if electronic
data is at issue.
Notify custodians and IT personnel of their duty to
preserve.
Suspend any deletion protocols.
Prohibit the destruction, loss, or alteration of any
potentially relevant documents.
Prohibit employees from destroying, hiding, or
manipulating documents.
Alert employees about the risk to the company and
the employees if they fail to heed the litigation hold
request.
The notice should be in writing, and it should be written
in a clear manner that is easy for non-legal and nontechnical employees to understand.
Moreover, establishing a litigation hold will help those
involved in an investigation identify the relevant
sources of information more quickly, and it will help
them understand the technology options available for
searching, analyzing, and reviewing data.
©2012
Conducting Internal Investigations: Planning and Logistics
5
NOTES
RESPONDING TO THE ALLEGATIONS: THE FIRST 24 HOURS
Identify Who Should Be Informed
Several departments should be interested in fraud,
including legal, human resources, internal audit,
security, risk management, and loss prevention. When
responding to an allegation of fraud, it is important to
consider the interests of each of these departments.
Typically, the general counsel should be made aware of
any significant fraud that may result in legal action.
Human resources (HR) deals with issues involving
unfair treatment, discrimination, harassment, substance
abuse, or concerns about corporate policies. Therefore,
the HR department should be informed of fraud that
affects any such areas.
Information distribution rules must be developed, and
several departments may be involved in this process.
Both the HR and legal departments should be involved
to ensure that the right people receive information in a
timely manner. Other departments, such as loss
prevention or risk management, audit, and security,
might need to be involved. These distribution rules
should already be set when investigation protocols are
in place.
The IT department should be part of an investigation to
safeguard data until it can be analyzed. IT personnel
can also help identify what data is available and where
it is located. Some IT staffers can even function as
forensic investigators if they are licensed to do so.
Identifying who should be informed is necessary to
ensure that designated executives are notified
immediately to enable a prompt response.
©2012
Conducting Internal Investigations: Planning and Logistics
6
NOTES
RESPONDING TO THE ALLEGATIONS: THE FIRST 24 HOURS
Conduct an Initial Assessment
Usually, when an allegation of fraud arises, there are
not enough known and verified facts to begin a formal
investigation and, therefore, management should
conduct an initial assessment to determine if an
investigation is needed and what steps, if any, are
required to respond in an appropriate manner. This
question is perhaps the most critical question that
management must answer when an allegation of fraud
arises.
To be of value, an initial assessment of suspicious
activity must be thorough and balanced, and it must be
conducted with intent to verify the facts.
Also, to avoid any real or perceived downplay of the
matter’s significance and to avoid any attempts at
willful blindness, the assessment’s findings must be
documented and reported accurately.
Moreover, the assessment, like any investigation,
should be conducted under the direction of counsel.
Unlike a formal investigation, however, the initial
assessment should be a limited, fact-finding analysis,
and it should focus on the specific allegation or
incident.
Therefore, if possible, the assessment should address a
number of questions, including:
 Is the allegation credible?
 Who is the subject of the allegation and what is his
relationship to the company?
 What was the business purpose of the activity
related to the allegation?
 How serious is the allegation?
©2012
Conducting Internal Investigations: Planning and Logistics
7
NOTES
RESPONDING TO THE ALLEGATIONS: THE FIRST 24 HOURS










What levels of employees are alleged to be
involved, if any, in the misconduct (i.e., officers,
directors, or managers)?
Did any third parties receive any direct or indirect
benefit from the misconduct, and, if so, who are
they?
If a third party is involved, is the third party a
government official?
How was the matter recorded on the company’s
books and records, if applicable?
Can it be determined if the person in question acted
with fraudulent intent?
Is it possible that the issue might be larger than
expected?
Were there any whistleblowers, and, if so, how
should they be dealt with?
What measures should the company take to
document how the initial evidence of wrongdoing
was handled?
Is the government already involved, and if not, is it
likely that the government will become involved?
Is it likely that the matter will have significant
negative impact on shareholder value?
Once management has assessed the issues listed above,
it can decide what actions to take.
In addition, the decision as to the appropriate response
can be influenced by other factors. Like any business
decision, the cost of conducting the investigation must
be considered; however, in many cases, the cost of not
conducting an investigation will be higher in the end.
Moreover, management should consider whether an
investigation will interrupt business activity. If
management decides against conducting an
©2012
Conducting Internal Investigations: Planning and Logistics
8
NOTES
RESPONDING TO THE ALLEGATIONS: THE FIRST 24 HOURS
investigation, it must document the reasons why it
chose to do so.
More specifically, the initial assessment should focus
on:
 Determining if fraud occurred
 Identifying the status of the fraud
 Reviewing any applicable policies and procedures
 Identifying potential claims and offenses
DETERMINE IF A FRAUD OCCURRED
The initial assessment should determine if a fraud
occurred. When making this determination, it is
important to differentiate between inadvertent
violations and those carried out with deliberate
criminal intent, which is an essential element of
fraud.
IDENTIFY THE STATUS OF THE FRAUD
The initial assessment should determine the status
of the fraud. This decision should be based in part
on answering all of the following questions:
 When did the fraud begin?
 Where did the violation come from? Was it
internal or external?
 Is the fraud still occurring?
 If the fraud is no longer occurring, when did it
stop?
REVIEW ANY POLICIES AND PROCEDURES
Those involved in the initial assessment must also
review any applicable internal controls and
company policies, including any anti-fraud auditing
and testing policies and procedures, to determine
the best method and processes for continuing the
investigation.
©2012
Conducting Internal Investigations: Planning and Logistics
9
NOTES
RESPONDING TO THE ALLEGATIONS: THE FIRST 24 HOURS
IDENTIFY POTENTIAL CLAIMS AND OFFENSES
When conducting the initial assessment, the fraud
examiner should consider the potential claims and
offenses—civil, criminal, and administrative—that
might be involved in the case.
Identifying potential claims and offenses is
important because fraud examiners are concerned
with fraud recovery. In practical terms, this means
examiners must be able to recognize which laws
were potentially violated, and they must be able to
match the facts and circumstances of a specific loss
to one or more legal causes of action. This will be
the legal theory of recovery.
Stop the Activity in Question
When management receives an allegation of suspicious
activity, it must stop whatever is happening from
continuing to happen.
Avoid Tipping Off the Fraudster
When responding to an allegation of fraud, those
responsible for investigating the allegation must avoid
tipping off the fraudster.
If the fraudster is tipped off, a number of different adverse
events might occur. For example, the fraudster could
attempt to destroy or alter evidence, making it more
difficult to conduct the investigation. When investigation
details are leaked, concealment and destruction of evidence
typically occur at a faster rate than if the investigation is
kept quiet.
Additionally, a tipped off fraudster might attempt to flee,
cut contact with associates, or point the blame at somebody
else. Some companies have processes in place to prevent a
©2012
Conducting Internal Investigations: Planning and Logistics
10
NOTES
RESPONDING TO THE ALLEGATIONS: THE FIRST 24 HOURS
fraudster from engaging in such conduct. For example,
some companies can suspend the suspect pending the
outcome of the investigation. This capability, however,
typically depends on the individual’s position in the
company.
If the suspect does find out about the investigation,
management will have to adjust the timeline accordingly,
which might mean interviewing the suspect earlier than
planned.
The confidentiality of an internal investigation is critical.
Who in the company has access to the investigative data,
files, and information? Do employees have to sign
confidentiality forms when they are interviewed? Are there
consequences if confidentiality is breached and
investigation details are leaked staff members?
Accordingly, it is important to be knowledgeable about
your organizations guidelines or policies. Do the applicable
internal investigation guidelines or policies have a “need to
know” clause and an “all access” clause? These clauses
allow you to keep the details of the investigation
confidential and grant the investigator access to necessary
company systems to gather evidence. Likewise, it is
important for an examiner to know whom he is
investigating and what he can access.
Identify the Investigation Leader
When an allegation of fraud arises, management must
designate someone to lead the initial assessment and
investigation. A leader should have investigative
experience and knowledge of legal and compliance
requirements regarding the specific type of allegation.
©2012
Conducting Internal Investigations: Planning and Logistics
11
NOTES
RESPONDING TO THE ALLEGATIONS: THE FIRST 24 HOURS
The leader should be chosen based on the allegation.
Management should consider whether to appoint an
internal resource (if available) or an external third party.
The leader should be independent of the activity affected
by the alleged fraud and have the means to recruit resources
necessary to conduct the investigation, sufficient authority
and access to gather any necessary information, and the
ability to communicate with senior management.
Contact the Complainant
If the allegation came in through a tip from an identified
source, the whistleblower should be contacted in case he
has additional information and to confirm his willingness to
continue to help throughout the investigation.
An interview with the complainant should seek to
determine:
 What the complainant knows







How the complainant got the information
Who were the key individuals involved
When the alleged events occurred (e.g., dates, times,
and locations)
What evidence exists to corroborate the alleged events,
where is the evidence located, and how the evidence be
can accessed
What witnesses can corroborate the alleged events
What the motivation behind the alleged events was
Why the alleged actions were improper
Even if the allegation was anonymous, management or the
investigative team should try to contact the complainant.
Some hotlines have the ability to provide a complaint
number and a phone number to the anonymous caller so he
can call back to check the status or to provide additional
©2012
Conducting Internal Investigations: Planning and Logistics
12
NOTES
RESPONDING TO THE ALLEGATIONS: THE FIRST 24 HOURS
information. Put follow-up questions in place if the tipster
does call back.
Also, if he uses an anonymous email address for contact,
then send an email with follow-up questions to that address
and see if you get an answer.
Obviously, this is a shot in the dark and might not provide
additional information, but at least the possibility exists that
more information could be gathered.
If the complainant reports an issue to a hotline and wants to
remain anonymous, then the company should investigate to
the extent they can with the information provided.
©2012
Conducting Internal Investigations: Planning and Logistics
13
NOTES
BUILDING THE FRAUD EXAMINATION TEAM
Introduction
Once it is determined that an allegation or issue will be
investigated and management has chosen the appropriate
party to own the investigation, consider what other parties
should compose the examination team.
The findings and observations collected up to this point
should be the primary factors used to determine who should
be involved in the investigation.
Structure the Investigation Team to Preserve
Confidentiality
If confidentiality issues are not given attention from the
outset of the examination, an organization might find itself
without options by the time third parties try to access
investigative materials. Certain evidentiary privileges and
discovery rules that offer the best basis for preserving
confidentiality depend largely on how the information was
gathered and secured by the team.
Therefore, to prevent third parties, including the subject of
the investigation, from gaining access to the examination
materials, management should consider conducting the
investigation under the attorney-client privilege and the
attorney work product doctrine. But to receive such
protections, the investigation must be conducted at the
direction of, or under the supervision of, legal counsel. The
findings from investigations not conducted under the
attorney-client privilege or the attorney work product
doctrine may be discoverable by private litigants as well as
government regulators.
Consider Implementing the Attorney-Client Privilege
The attorney-client privilege is an evidentiary privilege
that protects against involuntary disclosure of
communications between clients and their attorneys.
©2012
Conducting Internal Investigations: Planning and Logistics
15
NOTES
BUILDING THE FRAUD EXAMINATION TEAM
This privilege provides a valuable defense against thirdparty attempts to discover materials.
The general rule is that the attorney-client privilege
only applies to confidential communications (verbal or
written) between a client and his attorney for the
purpose of giving or receiving legal advice, but courts
have extended the privilege to include client
communications with non-lawyers (e.g., fraud
examiners) who are working under the direct
supervision, direction, and control of the lawyer.
Communications will generally be protected under the
attorney-client privilege if the following elements are
present:
 Confidential communications (oral or written)
 Between an attorney and client (or vice versa)
 Made for the purpose of giving or receiving legal
advice
Communications do not need to take place after a
lawsuit has been filed to be privileged, but if they do
not meet all of the above criteria, they are not
privileged.
The attorney-client privilege, if properly implemented,
provides some protection from discovery of internal
reports by the subject of the investigation, the
government, or third parties. The privilege also helps
protect the confidentiality of witnesses. However, it
does not protect the underlying evidence or documents
that do not meet the criteria outlined above, and it
cannot be claimed retroactively to cover work done
before counsel was involved.
©2012
Conducting Internal Investigations: Planning and Logistics
16
NOTES
BUILDING THE FRAUD EXAMINATION TEAM
Consider Implementing the Attorney Work Product
Doctrine
The attorney work product doctrine offers limited
protection for tangible materials (e.g., work papers,
interview notes, or memos) that are prepared at the
direction of counsel and in anticipation of litigation.
The work product doctrine is designed to protect the
thoughts and strategies of counsel, so work papers,
interview memos, or verbatim transcripts that do not
reflect such matters might not be protected.
The protection afforded by the work product doctrine
not only extends to information and documents
prepared by a party or the party’s attorneys—it may
also apply to materials prepared by consultants and
experts who were hired by the attorney. Accordingly,
the rule might protect the work product of a company’s
fraud examiner if the examiner’s work was conducted
in anticipation of possible litigation.
As stated above, the work product privilege only
protects tangible materials that are prepared in
anticipation of litigation. Litigation must be actually
planned and the work for which protection is sought
must have been undertaken for the specific purpose of
preparing for that litigation.
When a fraud examination is conducted in response to
known or suspected employee misconduct, it will
generally qualify as work done in anticipation of
litigation. If the investigator is merely auditing the
company’s procedures to ensure against the possibility
of future losses, however, the work product of the audit
probably will not be protected.
©2012
Conducting Internal Investigations: Planning and Logistics
17
NOTES
BUILDING THE FRAUD EXAMINATION TEAM
Identify What Skills Are Needed to Conduct the
Investigation
To determine who should be involved in the investigation,
identify what skills are needed. Fraud examinations usually
require a cooperative effort among different disciplines.
Auditors, fraud examiners, managers, attorneys, security
personnel, and others are all frequently associated with
fraud investigations.
Selecting the right team members is essential to conducting
an effective fraud examination. When choosing the
participants, identify those who can legitimately assist in
the investigation, who have a legitimate interest in the
outcome, and who have the skills needed for the specific
case.
The team should work together to minimize risks and
losses associated with the fraud. This will increase the
chances of a successful investigation.
Consider all of the implications that can arise from an
investigation. These implications include the business,
legal, human resources, and operational factors that arise
when an investigation commences. Addressing these
potential issues up front will ensure that significant factors
(e.g., the team members’ abilities, the leading executives,
and the assurance of independent action and reporting) are
considered.
If the team does not have guidelines or protocols in place to
ensure that the attorney-client privilege and attorney work
product doctrine are not compromised during the
investigation, members should establish such protocols
with the assistance of legal counsel.
©2012
Conducting Internal Investigations: Planning and Logistics
18
NOTES
BUILDING THE FRAUD EXAMINATION TEAM
The team should be composed of professionals with the
skills to deal with various types of incidents. To acquire the
appropriate level and mix of skills, the team should include
internal resources (if available) and external resources, if
needed or appropriate.
Typically, team members should have:
 Accounting and audit knowledge
 Knowledge of the industry
 Knowledge of the organization

Knowledge of the laws and rules of evidence in the

jurisdiction where the fraud occurred
Knowledge about privacy issues in the jurisdiction
where the fraud occurred and where the investigation
will occur
An understanding of psychology and motivational
factors
Interviewing skills in the suspect’s native language
Communication skills

Computer skills



A successful fraud examination, however, depends not only
on the knowledge and skills of individual members, but
also on the individual team members’ characteristics that
facilitate team interaction and functioning. These
characteristics are especially critical for teams that require
more coordination.
Internal Versus External Expertise
When building a team, you should determine whether
outside expertise is needed or whether it is available inhouse. To choose between internal or external specialists,
weigh the advantages between the two.
In some cases, particularly when the suspect is a powerful
or popular employee, it might be useful to employ outside
©2012
Conducting Internal Investigations: Planning and Logistics
19
NOTES
BUILDING THE FRAUD EXAMINATION TEAM
specialists who are relatively immune from company
politics or threats of reprisals.
Outside experts might also have greater experience and
investigative contacts than insiders, which gives them more
influence with senior executives who may prefer input from
outsiders. Additionally, using outside experts gives the
fraud examination the appearance of independence, and this
can be very important when reporting to or dealing with the
government.
Conversely, insiders often provide certain benefits. Insiders
have an in-depth knowledge of the organization, its
workings, its culture, and its processes and procedures.
Consequently, insiders might be better suited for evaluating
the significance of evidence, or its absence, than outsiders.
Also, insiders often know the personalities of those
involved.
Select the Team
Once you have identified the skills needed to conduct the
investigation, select the team. A typical fraud examination
might include the following professionals:
 Certified Fraud Examiners (CFEs)
 Legal counsel
 Local international counsel
 Accountants or auditors (internal or external)
 Audit committee members
 Security personnel

Human resources (HR) personnel
 A representative of management
 Information technology (IT) personnel

Computer forensic experts
 E-discovery specialists
 External consultants
©2012
Conducting Internal Investigations: Planning and Logistics
20
NOTES
BUILDING THE FRAUD EXAMINATION TEAM
Certified Fraud Examiners
Certified Fraud Examiners (CFEs) are trained to
conduct complex fraud cases from inception to
conclusion. A CFE has training in all aspects of a fraud
examination and therefore can serve as a valuable
“hinge” to the investigation team, tying together the
financial examination and the more traditional
investigative techniques.
Legal Counsel
It is crucial to have counsel involved in and, in most
cases, “directing” fraud examinations, at least as far as
the legal aspects of the process are concerned (e.g.,
reporting the results, preserving confidentiality,
avoiding lawsuits, or terminating employees for
wrongful misconduct). Fraud examination can be a
veritable hornet’s nest of legal questions, and the team
must have counsel on hand to sort through them,
otherwise the company risks exposing itself to greater
danger than the threat it is investigating.
In addition, by having an attorney directing or
overseeing the investigation, the company might be
able to protect the confidentiality of its investigation
under the attorney-client privilege and the work product
doctrine.
Local International Counsel
Management should obtain the help of local
international counsel before beginning a fraud
examination abroad.
Local international counsel is needed to address a
number of various issues that arise when working in
foreign jurisdictions. For example, local counsel will be
able to provide advice concerning applicable privileges
©2012
Conducting Internal Investigations: Planning and Logistics
21
NOTES
BUILDING THE FRAUD EXAMINATION TEAM
in the foreign jurisdiction. Likewise, consulting with
local counsel can provide guidance as to whether local
laws afford employees privacy rights that might
interfere with the investigation.
Accountants or Auditors
Because accounting and audit knowledge is necessary
to most fraud examinations, a team might include
accountants or auditors, whether internal or external.
Auditors can support the investigation with information
on company procedures and controls. Internal auditors
are often used to review internal documentary evidence,
evaluate tips or complaints, schedule losses, and
provide assistance in technical areas of the company’s
operations. Additionally, auditors can assess the
probable level of complicity within the organization,
and they can help design procedural methods to identify
the perpetrators and help determine the extent of the
fraud.
Audit Committee Members
As a result of the passage of the Sarbanes-Oxley Act,
audit committees are taking a more active role in
internal investigations. This has occurred, in part,
because the Sarbanes-Oxley Act mandates that audit
committees for publicly traded companies be directly
responsible for two key components of an effective
fraud prevention program—outside audits and internal
reporting mechanisms. Accordingly, a company’s audit
committee may actively oversee a fraud examination or
require that the investigation team report directly to it.
Security Personnel
Security department investigators are often assigned the
investigation’s fieldwork responsibilities, including
©2012
Conducting Internal Investigations: Planning and Logistics
22
NOTES
BUILDING THE FRAUD EXAMINATION TEAM
interviewing outside witnesses and obtaining public
records and other documents from third parties.
Human Resources Personnel
The human resources department should be consulted
to ensure that the laws governing the rights of
employees in the workplace are not violated. Such
involvement will lessen the possibility of a wrongful
discharge suit or other civil action by employees.
Although the team might need advice from a human
resources specialist, normally this person would not
directly participate in the investigation.
A Representative of Management
A representative of management or, in significant cases,
the audit committee of the board of directors, should be
kept informed of the progress of the investigation and
should be available to lend necessary assistance.
Information Technology Personnel
If fraud occurs, it is likely that a computer was
involved; if so, IT personnel may need to be part of an
investigation to help identify and locate available data
and safeguard it until it can be analyzed.
Computer Forensic Expert
When developing a fraud examination plan,
management should determine whether a computer
forensic expert is needed. Due to the sensitivity of
digital evidence, the team should include a computer
forensic expert if an investigation involves more than
cursory analysis of electronic evidence.
Computer forensic experts can uncover a large amount
of data that relates to the use of a computer, what is or
©2012
Conducting Internal Investigations: Planning and Logistics
23
NOTES
BUILDING THE FRAUD EXAMINATION TEAM
has been stored on it, and the details about the
computer’s users.
Also, it is important to allow a trained examiner to
conduct a proper seizure and examination on digital
evidence to help ensure that the information can be
used in legal proceedings.
Within the computer forensic field, there are several
different types of experts:





Operating and file system experts: These experts are
proficient in certain operating systems (e.g.,
Windows 7, Unix, Solaris, OS X, or AS400) and the
various file systems they employ (e.g., Joliet,
NTFS, FAT, VFS, Ext2), and they have the ability
to convey operational characteristics and observe
artifacts.
Data recovery experts: Using special tools and
equipment, these experts can salvage data from
damaged, failed, corrupted, or inaccessible media.
Forensic accounting experts: A forensic accountant
can provide various services, including audits,
accountant performance reviews, and examinations
of financial documents for fraud, misconduct, or
industry standard violations.
Tape and archival extraction experts: Tape and
archival extraction experts are knowledgeable in
extracting information from tape or other system
backups. Typically, backup solutions archive data in
proprietary formats, making extraction very
cumbersome.
Intrusion and malicious code experts: These experts
specialize in investigating computer network
intrusions. Specialists can determine attack vectors,
the tools employed, what occurred during access,
and what, if anything, was taken.
©2012
Conducting Internal Investigations: Planning and Logistics
24
NOTES
BUILDING THE FRAUD EXAMINATION TEAM
Given the diversity of computer-related fraud, no
person can be an expert in all aspects of computer
technology.
Moreover, in cases involving litigation, a forensic
expert can help parties draft interrogatories and requests
for production designed to solicit relevant data. They
can also help prepare and participate in depositions
involving record custodians.
E-Discovery Specialists
E-discovery and data-preservation specialists can
provide technical expertise in managing and reviewing
electronic data. These specialists use sophisticated tools
to search and analyze mounds of data for keywords,
phrases, names, dates, and other information that will
help identify potential indicators of fraud. Moreover, ediscovery specialist can help ensure that all relevant
records are preserved.
External Consultants
When conducting a fraud examination, examiners
should determine whether an external consultant is
needed. Consultants are particularly helpful when the
suspect is in a position of power.
Do’s and Don’ts for Selecting Team Members
This discussion summarizes the do’s and don’ts for
selecting team members. Some of the basic do’s include:
Consider the team’s size.
 Check for any conflicts of interest between internal and
external team members.


Ensure there are no reporting issues (e.g., a team
member feels pressure to report all details of the
investigation to his direct manager, even though the
manager does not have a need to know). Reporting
©2012
Conducting Internal Investigations: Planning and Logistics
25
NOTES
BUILDING THE FRAUD EXAMINATION TEAM





issues can be prevented by establishing confidentiality
rules in the beginning of the investigation.
Select members who fit the investigation’s demands
and objectives.
Recruit team members with the skills needed to conduct
the investigation.
Recognize the unique knowledge, experience, and skills
that each team member can contribute.
Contemplate the ways that each potential member will
fit into the team.
Select people who will work well with other team
members.
The don’ts for selecting team members include:
 Don’t select team members based on friendship.
 Don’t select team members to repay a favor.
 Don’t select team members with negative attitudes.
 Don’t overlook team members with untraditional
knowledge that can contribute to the investigation (e.g.,
people with experience in a particular industry).
 Don’t select members who might have personality
conflicts with other members.
Allocate Necessary Resources
As with any special investigation or operation that requires
advance preparation, the planning process must include
efforts to adapt the resources needed to deal with the
variety of issues that might occur during the examination.
This is especially true if the relevant operations are in
developing economies, remote locations, or areas with a
higher risk of security-related incidents.
Management should also identify resource limitations so
that the team can meet realistic objectives and develop
alternative strategies.
©2012
Conducting Internal Investigations: Planning and Logistics
26
NOTES
BUILDING THE FRAUD EXAMINATION TEAM
Managing the Fraud Examination Team
As with participants in most group efforts, members of a
fraud examination team need to work together to capitalize
on their strengths and produce the best results.
A team approach to examinations is often more productive
than an individual approach. However, teams comprise
individuals who bring different values, beliefs, agendas,
and experiences to the group. This can lead to challenges,
but it can also provide new insights and foster learning
among the members.
Although working in teams is often a superior technique for
learning and problem solving, these benefits can be lost if
there is dysfunction among the individuals (e.g., there is
unequal participation by the team members, or one group
member dominates the team’s efforts). Team performance
is dependent on a variety of factors and qualities within the
group and for a team to achieve its goals, each member
must work together. A poorly functioning team likely will
elevate members’ stress levels more than if an individual
was working alone.
In a team examination, members must focus their attention
on the final collective goal, even though all the members
will have different specialties that are applied toward the
goal.
Effective teamwork, however, does not come easy for those
who were educated and trained in different disciplines or
who work in different fields or departments. Although
varying traits can serve a client or employer well in a fraud
examination, the same traits can be counterproductive when
establishing a consensus with colleagues on the best
strategy. Thus, to conduct a successful fraud examination, a
team must be more than just a collection of individuals.
©2012
Conducting Internal Investigations: Planning and Logistics
27
NOTES
BUILDING THE FRAUD EXAMINATION TEAM
Characteristics of Effective Teams
Effective teams share certain characteristics, including:
 Mutual trust
 Respect for team members
 High level of commitment
 Mutual support for each other
 Appreciation for others’ strengths and reduction of
their weaknesses
 Effective communication
 Clarity in the team’s objectives

Productive conflict resolution

Environment that encourages respect for individual
differences
Organization
Flexibility
Individual responsibility for contribution to the
team’s goals
Appropriate use of social skills




Characteristics of Ineffective Teams
Ineffective teams share certain problems, including:
 Lack of commitment to common objectives
 Objectives that are not meaningful to members
 Members who do not discuss team processes
 Unclear goals
 Undefined roles and responsibilities for the team
members
 Overbearing or dominating members
 Disagreements among members that are not dealt


with effectively
Members who do not carry their weight
Feuding members


Accepting opinions as fact and without question
Moving too quickly
©2012
Conducting Internal Investigations: Planning and Logistics
28
NOTES
BUILDING THE FRAUD EXAMINATION TEAM
Four Developmental Stages of Teams
Individuals working together toward a shared goal tend
to move through four phases:
 Forming
 Storming
 Norming
 Performing
FORMING
In this stage, the team members get together for the
first time. At this point, the team’s dynamics,
values, and traits are undefined, and the team
members are uncertain of their roles and
responsibilities.
During this stage, the members assess each other
and identify how they fit into the group.
During formation, team members disagree on the
team’s objectives, allowing the group to work
together to define the team’s purpose, identify its
goals, and establish ground rules for how members
should work together.
STORMING
In the storming stage, the members begin to push
their own point of view and conflict arises as
individuals begin to struggle with their differences.
To be effective, the members must work through
their conflict in a way that fosters creativity. They
must deal with their differences and employ a
strategy for productive conflict resolution. This
stage tests the loyalty of the members to the team’s
goals. A team that does not resolve conflicts among
its members will not reach its potential.
©2012
Conducting Internal Investigations: Planning and Logistics
29
NOTES
BUILDING THE FRAUD EXAMINATION TEAM
NOTES
NORMING
In the norming stage, the team members accept and
appreciate the differences among themselves and
begin to trust each other. This drives the group to
develop a stronger commitment to the team’s goals.
PERFORMING
In this stage, the members become a productive and
effective team. During this stage, team members
trust each other and the group progresses toward a
shared vision.
©2012
Conducting Internal Investigations: Planning and Logistics
30
PROJECT MANAGEMENT AND THE FRAUD EXAMINATION
Introduction
As with most large projects, the success of a fraud
examination is often made or broken by how it is managed.
Successfully managing an investigation involves navigating
many challenges, such as breaking down the boundaries
between departments and developing goals that each team
member can accept. This section addresses these issues and
more, focusing on ways to manage fraud examinations
conducted by teams. Specifically, it explains:
 Outlining the investigative course of action

Identifying phases, tasks, and checkpoints

Planning the investigation effectively
 Managing the investigation team
 Monitoring the progress of the investigation
 Balancing conflicting resources and demands for time
Outlining the Course of Action
Before beginning a fraud examination, the team members
should gain a basic understanding of the central issues of
the case and outline the course of action they expect to
take.
The following is a list of questions the team will typically
want answered before beginning a fraud examination:
 What is the time frame?
 What is the nature of the suspected fraud?
 Where are the relevant locations?
 Who is the contact at the locations?
 Who are the targets?

Does the issue predate any of the key players?
 Are there deadlines and, if so, what are they?
 Are there any reporting requirements?

Have any related fraud examinations ever been
conducted at this location?
 What other entities might be involved?
 What other sites might be involved?
©2012
Conducting Internal Investigations: Planning and Logistics
31
NOTES
PROJECT MANAGEMENT AND THE FRAUD EXAMINATION






Does management perform background checks on
employees as a precondition of employment?
Did the suspected fraud occur in an industry or location
that has a history or culture of fraud?
Has the organization been in compliance with reporting
and regulatory requirements?
What is the profitability of the unit or organization at
issue in the investigation?
Does the organization’s level of growth make sense in
light of its industry and peers?
Has there been a recent acquisition and, if so, is former
management still in place?
 Does the organization have a fraud policy?
 What type of report, written or oral, does the client
expect?
 What is the budget?
Among other things, the course of action should identify
the information necessary to complete the investigation and
include the investigative activities to be performed. For
example, the outline should include items such as:
 Who will be interviewed and when?
 What documents will be requested?
 If the team is to prepare a report of the investigation,
what form should the report take and when should it be
completed?
The procedures performed during an investigation will vary
from case to case, and they can include a number of
different measures. The actual procedures performed might
include, but are not limited to, the following measures:
 Obtain any available records of the allegations, such as
the hotline report, anonymous letter, and so forth.
 If the incident was reported, interview the person who
made the report if his identity is known and if he is
willing to be interviewed. (Note that in all cases, it is
©2012
Conducting Internal Investigations: Planning and Logistics
32
NOTES
PROJECT MANAGEMENT AND THE FRAUD EXAMINATION
important to safeguard the whistleblower’s identity and
any information concerning the whistleblower.)
 Determine what documents and data are critical to the
examination and any potential subsequent investigation,
and take measures to safeguard and secure the
information.
 Gather supporting documentation related to the
suspicious activity. This can include disbursement
records, travel records, meeting minutes, and so on.
 Identify employees or third parties who might have
information and conduct fact-finding interviews.

Summarize the findings and meet with counsel and the
appropriate individuals to determine what subsequent
steps, if any, are required.
Moreover, during the course of the examination, the
circumstances will change and new information will
emerge; therefore, the team and management should
continuously refine and modify the plan throughout the
investigation.
Identifying Phases, Tasks, and Checkpoints
Fraud investigations are best managed as a series of
structured phases, providing a coherent flow for execution
and allowing for review and ongoing reflection. And once
the team completes a phase, it should be marked as a
milestone.
Generally, a fraud examination will include the following
five phases:
 Conduct a preliminary assessment.
 Form the investigative team and assign responsibilities.

Plan the investigation.
 Conduct the investigation.
 Prepare a report on the investigation.
©2012
Conducting Internal Investigations: Planning and Logistics
33
NOTES
PROJECT MANAGEMENT AND THE FRAUD EXAMINATION
For a fraud examination to allow for review and ongoing
reflection, each phase of the investigation should include
defined tasks and checkpoints to provide a foundation for
analysis and evaluation, allowing the team to determine
whether the investigation is going as planned.
Each of the five phases of a fraud examination can be
broken down into tasks and checkpoints. Like goals, tasks
and checkpoints are necessary to provide focus and
direction; they also provide the team with benchmarks for
determining whether they are succeeding. To provide
guidance and set benchmarks, tasks and checkpoints
should:
 Be clear and specific so that each team member
understands exactly what is expected.
 Contain measureable standards (e.g., dates, amounts,
etc.) that can be used to track progress and motivate
team members.
 Be attainable.

Be challenging in a way that provides an opportunity
for the team to stretch their skills.
 Be developed by and agreed upon by the team.
The list below demonstrates how a fraud examination can
be divided into phases and checkpoints:
 Conduct a preliminary investigation:
 Determine if fraud occurred.
 Identify the status of the fraud.
 Review any applicable policies and procedures.
 Identify potential claims and offenses.
 Form the investigative team and assign responsibilities.
 Plan the investigation:




©2012
Determine the goals of the investigation.
Determine the scope of the investigation.
Establish a line of authority.
Allocate necessary resources.
Conducting Internal Investigations: Planning and Logistics
34
NOTES
PROJECT MANAGEMENT AND THE FRAUD EXAMINATION


Determine the need for law enforcement assistance.
Structure the investigation to preserve
confidentiality.
 Select the best approach.
 Outline the investigation.
 Establish the time frame for the investigation.
 Conduct the investigation:
 Gather relevant documents (e.g., files, computer
files, memos, letters, emails, etc.).
 Record and store information appropriately.
 Manage documentary evidence.

 Review documentary evidence.
Interview relevant individuals:
 Identify who should be interviewed.
 Identify who should interview the witnesses.
 Determine when the witnesses should be
interviewed.
 Determine where the witnesses should be
interviewed.
 Determine how the witnesses should be
interviewed.
 Record and store information appropriately.
 Prepare a report on the investigation.
Once the team’s tasks and checkpoints are established,
identify the skills needed to complete them and delegate the
tasks based on the members’ skills and experience.
Once the tasks are assigned, team members must track their
progress to help leaders can provide assistance or resources
when needed. Additionally, having the documenting
progress is helpful when reviewing past performance.
Planning the Investigation
As noted above, successfully managing a fraud
examination involves giving deliberate attention to several
©2012
Conducting Internal Investigations: Planning and Logistics
35
NOTES
PROJECT MANAGEMENT AND THE FRAUD EXAMINATION
specific items during the planning phase before the
investigative work is commenced.
Defining the Goals of the Investigation
At the outset of the engagement, management should
consider and articulate the goal or purpose of the
investigation. In general, fraud investigations are
centered on finding evidence to prove fraud and recover
any losses. Consequently, the goal of most fraud
investigations will be to determine whether fraud
occurred and, if so, who perpetrated it.
Once the goals are defined, the examination can be
designed to uncover evidence that will answer these
questions. Generally, a fraud investigation should be
designed to:
 Prevent further loss or exposure to risk.
 Determine if there is any ongoing conduct of
concern.





Establish and secure evidence necessary for
criminal or disciplinary action.
Minimize and recover losses.
Review the reasons for the incident, investigate the
measures taken to prevent a recurrence, and
determine action needed to strengthen future
responses to fraud.
Help promote an anti-fraud culture by making it
clear to employees and others that the organization
will pursue all cases vigorously, taking appropriate
legal or disciplinary action where it is justified.
Protect the company’s legal privileges.
Determining the Scope of the Investigation
Management must determine the scope of the
investigation. For example, it might be limited to the
subject matter or the geographic area at issue. The
©2012
Conducting Internal Investigations: Planning and Logistics
36
NOTES
PROJECT MANAGEMENT AND THE FRAUD EXAMINATION
scope will depend on a number of factors, and
management should use the following guidelines to
help determine the scope:
 Develop a list of key issues raised in the initial
assessment.
 Consider the quality of the organization’s anti-fraud
program and policies.
 Consider the organization’s actual culture of
compliance.
 Consider the risk profile of the department from
which the suspicions stem.










Examine the nature of the suspected misconduct.
Identify how many people or business units are
involved in the suspected conduct.
Determine the extent to which mid- and senior-level
management is involved in the suspected
misconduct.
Determine whether the issue is widespread or
isolated to a particular area.
Consider what the government expects.
Determine the period of time over which the
suspected misconduct occurred.
Ascertain whether the suspected misconduct was
prohibited by the company’s anti-fraud program.
Consider broadening the scope of the investigation
if the allegations indicate a failure in the company’s
anti-fraud program.
Decide whether a civil or criminal suit is likely.
Determine whether the issue is likely to result in
adverse publicity.
To determine the scope, management should also
consider how the issue became known (i.e., what
prompted the investigation). Fraud issues can arise from
a number of different sources, which will prompt
different responses. If, for example, the issue came to
©2012
Conducting Internal Investigations: Planning and Logistics
37
NOTES
PROJECT MANAGEMENT AND THE FRAUD EXAMINATION
light during a government investigation, the company’s
examination should shadow the government’s actions.
Some common sources of allegations include:
 Concerns from the board of directors, executives, or
management
 Whistleblower allegations from known and
anonymous sources
 Internal audit findings or concerns
 Complaints from vendors, contractors, subcontractors, and so on






Competitor complaints
Regulator inquiry
Government investigators
Foreign government or officials
Media sources (newspapers, journalists, etc.)
Prospective purchasers
Establishing a Line of Authority
If the organization does not have a pre-established line
of authority in its fraud policy or investigative
protocols, management should define the team’s
authority levels, responsibilities for action, and
reporting lines for suspected or alleged violations
during the planning process. Management should define
the line of authority to avoid conflicts from competing
interests between departments and team members.
Planning for Document Collection
Documents provide the foundation of the case on which
the examiner will build the structure of the
investigation. Documents can be evidence in
establishing that a fraud was committed, in determining
the nature and scope of the fraud, or in identifying the
parties responsible.
©2012
Conducting Internal Investigations: Planning and Logistics
38
NOTES
PROJECT MANAGEMENT AND THE FRAUD EXAMINATION
To conduct a successful investigation, the fraud
examiner must know what to look for and where to look
for it. Often, it is necessary to meet with a member of
the organization to discuss the types of evidence that
might be required and to locate that evidence.
The team should consider developing a plan for the
collection of documents to focus efforts on material
most likely to be relevant and avoid collecting an
excessively broad amount of documents.
Additionally, the geographic location of data should be
considered. Outside the United States, many countries
have enacted data privacy laws and regulations that
might affect a global investigation.
To develop a document collection plan, the team
should:
 Identify the types of documents that can help the





fraud examination.
Make a list of potential sources of relevant
information (e.g., file cabinets, suspect’s office,
personnel department, accounting department, thirdparty sources, etc.).
Determine how and if the documents should be
collected.
Identify who will collect the information.
Identify areas that need to be processed
immediately and prioritize the collection of
documents.
Determine when the data should be collected and
where it will be stored after collection.
When requesting, obtaining, and maintaining
documents for a fraud examination, the team should
address a number of other considerations, including:
©2012
Conducting Internal Investigations: Planning and Logistics
39
NOTES
PROJECT MANAGEMENT AND THE FRAUD EXAMINATION






Are there any internal reports (e.g., audit,
compliance, security, legal, due diligence, risk
management, ethics, etc.) available for review?
Is employee email available for review?
Are there computer resources (e.g., laptops,
desktops, etc.) that need to be secured?
Where are the digital records stored?
What types of public records would be helpful to
the fraud examination?
Are there any documents held by third parties that
might be useful?
Planning for Interviews
As with all other phases of a fraud investigation, an
interview will be most successful if the interviewer is
thoroughly prepared. To be prepared, the interviewer
should have a clear idea of what information he wants
to obtain and what information the subject should be
able to provide, and he should have a game plan for
how to obtain that information.
Here is a list of questions that should be addressed
when planning for interviews:
 What are the matters or issues that are important to
the interview?
 What is the objective of the interview?
 What are the legal or administrative requirements
that the interview will seek to support?
 What evidence or information will be sought during



©2012
the interview?
What documentation should be gathered to support
the interview?
If an allegation has been made, what documentation
is necessary to support or refute the allegation?
What interview approach is likely to be the most
effective?
Conducting Internal Investigations: Planning and Logistics
40
NOTES
PROJECT MANAGEMENT AND THE FRAUD EXAMINATION








Who will be present during the interview?
Who will participate in the interview?
Who will lead the interview?
Where will the interview take place?
When will the interview take place?
How long will the interview take and will there be
enough time?
Will the interview be recorded and, if so, how?
What is likely to happen after the interview?
Determining the Need for Law Enforcement
Assistance
The planning stage of the investigation should also
include considering the need for law enforcement
assistance. That is, management must decide if the issue
is serious enough to call in the police or other law
enforcement entities. Whether to seek assistance from
law enforcement can be a difficult decision for
companies to make.
If, at the beginning of the investigation, management
determines that it will make a formal referral to law
enforcement or a prosecuting agency, then it must
notify the authorities before the investigation
commences to determine whether law enforcement
personnel should participate in the examination.
Other Planning Considerations
Throughout the planning process, management should
consider three key factors:
 The governing laws on fraud
 The locations of company data

©2012
Laws that will affect obtaining data and reviewing
documents
Conducting Internal Investigations: Planning and Logistics
41
NOTES
PROJECT MANAGEMENT AND THE FRAUD EXAMINATION
Dealing with Underperforming Team Members
The anti-fraud profession is full of hardworking, dedicated
individuals putting in far more hours than what is required
of them, but, like all professions, it has members who
underperform.
Underperforming team members are individuals who have
a detrimental effect on the team’s productivity, morale, or
deliverables, and these individuals put the investigation’s
success at risk. And in the anti-fraud profession, where
demands are high and budgets are tight, even one
underperforming team member can put pressure on an
investigation. Therefore, team leaders must deal with
underperforming team members to promote healthy team
dynamics. Even high-performing, valued members of a
team can be toxic to other team members and the team’s
work.
To understand why members underperform, it is necessary
to examine performance.
Four Parts of Performance
An individual’s performance comprises four parts:
 Skills: This refers to a member’s capability for
doing his job.
 Motivation: This refers to the member’s desire to do
his job.
 Alignment: This refers to the member’s
understanding of the team’s goals and directions
and of his role in meeting them. Thus, leaders must
communicate expectations to team members in an
open and clear manner.

©2012
Structure: This refers to the team’s organization. A
team must be organized in a way that allows all
members to perform their work.
Conducting Internal Investigations: Planning and Logistics
42
NOTES
PROJECT MANAGEMENT AND THE FRAUD EXAMINATION
The Causes of Underperformance
Underperformance can have various causes and the
appropriate response to it will differ based on the cause.
Thus, team leaders must be able to identify the reason
for performance issues to know how to properly
respond.
Below is a list of causes for a team member’s
underperformance:
 Lack of skills: A member might underperform
because he lacks the ability to do his job.



Lack of motivation: If a team member is not
motivated, he will not perform. Often, poor
relationships among team members can affect
motivation for performance. For example, if a team
member feels ostracized or underappreciated, these
feelings will affect their work.
Lack of alignment: If a member does not understand
what goals the team needs to meet, he will fail at his
role. Often, team members who are unclear about
their roles will fail to do things or do things that are
unnecessary.
Poor team structure: If a team is not organized in a
way that allows each member to perform their
work, they are bound to fail because the system has
set them up for failure.
Five-Step Process for Dealing with
Underperformance
Here is a five-step process for dealing with
underperforming team members.
STEP 1: IDENTIFY THE PROBLEM
The first step to dealing with underperformance is
to determine what is causing it. To do this, analyze
the reasonableness of the team member’s role and
©2012
Conducting Internal Investigations: Planning and Logistics
43
NOTES
PROJECT MANAGEMENT AND THE FRAUD EXAMINATION
responsibilities. Are they realistic? Does the
individual have the resources to do the job
effectively? Is it a personal issue?
STEP 2: COMMUNICATE THE PROBLEM
Once the problem has been identified, the leader
should communicate the issues with the
underperforming person. Leaders should not be
reluctant to address concerns; they should be ready
to address issues as they occur. Communication is
important because it provides an opportunity for
discussion and feedback.
When communicating the problem to the team
member, the leader should convey it in a positive
light (i.e., seek to convince the team member that
this is an opportunity for them to grow). More
specifically, the leader should:
 Explain the expectations he has for the team
member.
 Tell the member how valuable he is to the team
(i.e., what he contributes).
 Explain the team member’ deficiencies and that
they are overshadowing the member’s value and
weakening the team’s dynamics. (Explain how
the team member is affecting the team’s work.)
 Make an assertion about what the team needs
without being threatening (i.e., explain to the
individual how he should perform in the future).
STEP 3: CREATE PERFORMANCE GOALS AND
MEASUREABLE OBJECTIVES
Once the problem has been communicated, the team
leader should create a performance plan for the
member. The plan should be designed to
communicate to the team member the specific areas
©2012
Conducting Internal Investigations: Planning and Logistics
44
NOTES
PROJECT MANAGEMENT AND THE FRAUD EXAMINATION
that do not meet expected standards and should do
the following:
 State the expected level of performance
improvement.
 Set objective goals.
 Give the member a timeline for corrective
action.
 Give explicit consequences for failure to meet
the objectives.
STEP 4: MONITOR THE TEAM MEMBER’S
PROGRESS
Once the performance goals and measureable
objectives are set, the leader should monitor the
member’s progress and conduct periodic reviews to
provide constructive feedback.
STEP FIVE: FOLLOW THROUGH WITH THE PLAN
At the end of the stated period, the leader must
determine if the team member met his assigned
objectives. If not, the leader must follow through on
the stated consequences.
Things to Avoid When Dealing with Underperforming
Team Members
Below is a list of things to avoid when dealing with
underperforming team members:
 Do not ignore underperforming team members
because doing so will cause dysfunction in the team


©2012
and can affect both morale and the leader’s
credibility.
Do not get rid underperforming team members who
add value to the team.
Do not pass underperforming team members on to
something or someone else (e.g., putting the
member on a special project or transferring them to
Conducting Internal Investigations: Planning and Logistics
45
NOTES
PROJECT MANAGEMENT AND THE FRAUD EXAMINATION

another team). This will not correct the problem.
What’s more, passing the problem will send a
message to the team that underperforming members
will receive special treatment.
Do not make quick judgments or jump to
conclusions. Avoid labeling team members because
doing so will affect your ability to view the
situation objectively, and it will prevent any
constructive discussion.
Measures to Help Avoid Underperformance
Below is a list of measures for avoiding
underperformance:
 At the beginning of the investigation, set goals and
outline expectations for each team member so they
know what they have to achieve. When all goals are
communicated openly, the probability that a team
member will fail to meet them is reduced. Goals
should be based on each member’s skills and



abilities.
Give ownership of a specific task or area to each
team member and require that they report on the
progress of the task. This will give each team
member responsibility for something.
Provide rewards and recognition to team members
who meet their goals.
Motivate team members by offering them
challenging roles.
Keeping Your Team Informed and on Task
Team members need to know the essential information
about the investigation. Otherwise, they might lose interest
in it, lose respect for the team’s ability to conduct a
thorough examination, or veer off track. It is the leader’s
responsibility to keep the team informed and on task.
©2012
Conducting Internal Investigations: Planning and Logistics
46
NOTES
PROJECT MANAGEMENT AND THE FRAUD EXAMINATION
This discussion examines some reasons why teams get off
task and how to ensure that the team stays informed and on
track.
Reasons Teams Get off Task
Here is a non-exhaustive list of reasons teams get off
track:
 Individuals are confused about the investigation’s
goals and scope.
 The planning is poor.

Leaders do not provide a clear timeline.

Team members have different goals and competing
priorities.
Members have personal agendas that impede
progress.
Individuals do not trust each other.
Team members work in isolation rather than
together.



Tips to Ensure That the Team Stays Informed and on
Task
Below is a list of ways to ensure that the team stays
informed and on track:
 Set and communicate team goals.
 Involve team members.
 Document the investigation plan.
 Evaluate the team’s process.
 Keep the team members informed.
 Consider assigning different tasks and

responsibilities to team members.
Set the correct tone.
SET AND COMMUNICATE TEAM GOALS
As mentioned, management must set goals for the
investigation at the outset. This will give the team
purpose, and it will give them checkpoints for
©2012
Conducting Internal Investigations: Planning and Logistics
47
NOTES
PROJECT MANAGEMENT AND THE FRAUD EXAMINATION
measuring success. Additionally, every team
member must be clear about the investigation’s
goals.
INVOLVE TEAM MEMBERS
Team members want to be involved in the
development and progress of the investigation and
they frequently have insightful ideas that can
improve the work.
DOCUMENT THE INVESTIGATION PLAN
The plan should provide a roadmap for the
investigation and include things such as timelines
and outlines. It should identify the investigation’s
primary goals and be concise and easy to read. The
plan should also outline the action required to
accomplish the stated goals.
EVALUATE THE TEAM’S PROCESS
Keeping the team on task requires assessing
processes and analyzing what worked and what did
not.
KEEP THE TEAM MEMBERS INFORMED
Communications are critical to a successful
investigation. Team members want regular updates
on the progress of the investigation and their
personal performance.
Use emails, memos, phones, group meetings, and
one-on-one meetings to keep team members
informed. Tell them about any current challenges,
and give them feedback on their performance. Also,
everyone should be made aware of new decisions,
steps taken, changes in plans, or other details that
are vital to the investigation.
©2012
Conducting Internal Investigations: Planning and Logistics
48
NOTES
PROJECT MANAGEMENT AND THE FRAUD EXAMINATION
Even if a team member is not involved in each
aspect of the investigation, every team member
should be knowledgeable about the investigation’s
details.
CONSIDER ASSIGNING DIFFERENT TASKS AND
RESPONSIBILITIES TO TEAM MEMBERS
If the team agrees, assigning different segments of
the investigation to different team members can
help organize the examination. For example, one
member could be in charge of communications,
another could be in charge of scheduling meetings,
and so on.
SET THE CORRECT TONE
If a team leader wants his team to be successful, he
must set the correct tone.
Monitoring the Progress of the Investigation
During the course of an investigation, it is important to
monitor the team’s progress. Often, the team leader will
monitor the progress, but the team can appoint a monitor to
oversee the team’s work. The monitor should be qualified,
trained, and experienced to track the investigation’s
progress.
In general, the monitoring process should include:
 Conducting an ongoing review of whether the manner
of investigation is appropriate
Comparing the investigation’s progress to the plan and
altering the plan when needed
 Maintaining the proper chain of the evidence


Consulting with team members regularly on their
progress in both informal sessions and scheduled
reviews
©2012
Conducting Internal Investigations: Planning and Logistics
49
NOTES
PROJECT MANAGEMENT AND THE FRAUD EXAMINATION

Tracking key tasks, deadlines, and timelines
 Monitoring the use of experts to ensure they are used in
a cost-effective way
A team leader might consider using a case management
software program. These programs can help manage data
and information gathered during the investigation, and they
can create reports, graphs, and charts of a particular case.
Balancing Conflicting Resources and Demands for Time
Individual team members will often face competing
demands for resources and time that can affect their ability
to perform their roles effectively.
To avoid such conflicts, seek to:
 Agree, at the outset, on the period during which the
team will operate.
 Agree, at the outset, about how much time team
members should spend in their roles.
Fill the team member’s regular job responsibilities if
the examination and other jobs will require more than is
reasonably available.
 Reward the team’s results separately from the
individual members’ job performances.

©2012
Conducting Internal Investigations: Planning and Logistics
50
NOTES
ABOUT THE ASSOCIATION OF CERTIFIED FRAUD EXAMINERS
About the ACFE
The Association of Certified Fraud Examiners (ACFE) is the world’s largest anti-fraud organization
and premier provider of anti-fraud training and education. Together with more than 60,000 members,
the ACFE is reducing business fraud worldwide and inspiring public confidence in the integrity and
objectivity within the profession.
Founded in 1988 by Dr. Joseph T. Wells, CFE, CPA, and former Federal Bureau of Investigation
(FBI) Special Agent, the ACFE has become the largest anti-fraud organization in the world. ACFE
members in more than 160 countries have investigated more than two million cases of suspected
criminal and civil fraud.
Members of the ACFE include CPAs; auditors; lawyers; investigators; law enforcement officers;
security professionals; executives; managers; and anyone whose job involves preventing, detecting, or
deterring fraud. The ACFE supports members and the anti-fraud profession by providing conferences,
seminars, and other training events year-round, while also offering self-study and online learning
opportunities, manuals, software, and other resources for fighting fraud.
By becoming an ACFE member, you will receive many valuable benefits that help to promote your
professional and career development. These benefits include access to members-only services and
resources, as well as discounts on many of the ACFE’s valuable products. To learn more about
becoming a member of the ACFE, visit our website at www.ACFE.com/Membership or call (800)
245-3321 (USA & Canada only) or +1 (512) 478-9000.
A Leader in Research
The ACFE supports the future of fraud examination by providing funding and resources through its
Anti-Fraud Education Partnership and Law Enforcement Partnership. ACFE research, including the
Report to the Nations on Occupational Fraud & Abuse, provides benchmarking statistics on fraud, and
the ACFE is one of the founding members of the nonprofit Institute for Fraud Prevention (IFP). The
IFP is a consortium of domestic and international universities dedicated to cutting-edge research into
the causational factors of a wide variety of white-collar crimes.
Certified Fraud Examiners (CFEs)
The ACFE established and administers the Certified Fraud Examiner (CFE) credential. Globally
preferred by employers, the Certified Fraud Examiner credential denotes proven expertise in fraud
©2012
ABOUT THE ASSOCIATION OF CERTIFIED FRAUD EXAMINERS
prevention, detection, deterrence, and investigation. Members with the CFE credential gain a
professional advantage and quickly position themselves as leaders in the global anti-fraud community.
CFEs are knowledgeable in four major areas critical to the fight against fraud:
• Fraudulent Financial Transactions
• Fraud Prevention and Deterrence
• Legal Elements of Fraud
• Fraud Investigation
To become a CFE, one must:
• Pass a rigorous examination administered by the Association of Certified Fraud Examiners (ACFE).
• Meet specific education and professional requirements.
• Be approved by the ACFE certification committee.
• Exemplify the highest moral and ethical standards and agree to abide by the bylaws of the ACFE
and the CFE Code of Professional Ethics.
• Maintain annual CPE requirements and remain an ACFE member in good standing.
To learn more about becoming a Certified Fraud Examiner, visit our website at:
www.ACFE.com/CFE.
As experts in the four major areas of fraud, CFEs are trained to see the warning signs and red flags that
indicate not just actual fraud, but fraud risk―potentially saving organizations thousands of dollars in
losses through prevention and detection before it’s too late.
CFEs have the ability to:
• Identify an organization’s vulnerability to fraud.
• Examine data and records to detect and trace fraudulent transactions.
• Interview personnel to obtain information.
• Write fraud examination reports, advise clients about findings, and testify at trial.
• Advise on improving fraud prevention and deterrence measures.
Learn more
For more information about the ACFE, visit our website at: www.ACFE.com.
©2012