If your organization has a strategy in place to deal with suspected fraud, you’re ahead of the game over those that suddenly come face to face with it.
Preserving evidence is key, though this can be a challenge without a proper strategy. Companies also have to decide what to do with the suspect(s) involved during investigations of fraud. Instead of a knee-jerk reaction, a solid plan will lay out how the higher ups in the organization react.
Avoid the temptation to immediately rifle through an employee’s computer. This could render evidence inadmissible in court. Include the detail of hiring computer experts in your strategy to properly preserve the digital evidence.
Paper documentation is also important to identify evidence, linking who’s involved and documenting access to potential witnesses.
One case FR had involved a suspect who was asked to leave his computer in the hall outside of his office – but he had more than enough time to replace the hard drive with a new one. It also gave him the opportunity to argue that someone else swapped it out afterwards. If the computer had been taken right away, he wouldn’t have been able to make that claim. Plus, the company would have been able to keep and file any evidence found on the original hard drive.
Consider what your company’s options are for what to do with the actually employee(s). Would they be fired, put on leave or allowed to keep working? Another case we ran involved a whistleblower report of fraud where an employee was paid to leave; the company was worried about its reputation if word got out.
A clear policy would mean the immediate seizure of computers or devices and any employees suspended pending an investigation. Finally, it all means a better chance at prosecution – plus sending the message to the rest of the workers that fraud won’t be tolerated.