Part A: Planning and methods
Introduction to planning and conducting investigations
Key takeaways
- A fraud or corruption investigation sets out to establish whether fraud occurred, identify who was responsible and how the scheme worked, quantify the loss, gather admissible evidence, and support asset recovery and prevention.
- It looks backward, establishing what happened for accountability and evidence, and forward, informing control improvements; the two functions must be balanced, not treated as afterthoughts.
- A fraud investigation is broader than forensic accounting or a forensic audit: it uses both, and also extends to interviewing, digital forensics and asset tracing.
- The methodology runs predication, fraud theory, evidence collection, analysis and corroboration, then reporting; predication needs only a reasonable basis to believe fraud has occurred or will occur, not proof.
- A fraud response plan, prepared before any allegation arises, sets out who is notified, who leads, how evidence is preserved and when law enforcement or regulators are engaged.
Objectives of fraud/corruption investigations
- Establish whether fraud or corruption actually occurred
- Identify who was responsible and how the scheme operated
- Quantify the loss suffered
- Gather evidence admissible in criminal, civil, or disciplinary proceedings
- Support recovery of assets and prevention of recurrence
Functions of a fraud investigation
A fraud investigation both looks backward (establishing what happened, for accountability and evidence) and forward (informing control improvements that prevent recurrence), functions that must be balanced rather than treated as sequential afterthoughts.
Fraud investigations, forensic accounting and forensic audit
A fraud investigation is the broadest of the three: it may use forensic accounting techniques and a forensic audit as components, both defined in CFFE Introduction to Forensic Accounting and Audit, but also extends to interviewing, digital forensics and asset tracing, each with a chapter of its own below, none of which sit within accounting or audit alone.
Fraud investigation methodology
- Predication: a reasonable basis to believe fraud has occurred or will occur, before an investigation is opened
- Developing a fraud theory, an initial hypothesis of what happened, tested and refined as evidence is gathered
- Evidence collection using the methods in the next chapter
- Analysis and corroboration of findings
- Reporting (see the chapter on report writing) and, where warranted, referral for prosecution or civil action
The fraud investigation methodology
Developing a fraud response plan
A fraud response plan, prepared before any specific allegation arises, sets out who is notified, who leads the investigation, how evidence is preserved, and when law enforcement or regulators are engaged, so that a real allegation is met with a rehearsed process rather than an improvised one.
Exam tip
Predication is the essential first checkpoint before any investigation opens, and a favourite exam concept, know that it requires only a reasonable basis to suspect fraud, not proof, investigating without any predication at all exposes the organisation to claims of harassment or defamation.
Self-check
(a) Define predication and explain why it must exist before an investigation opens. (4 marks)
(b) State three objectives of a fraud investigation besides establishing whether fraud occurred. (3 marks)
(c) Explain the difference between a fraud investigation's backward-looking and forward-looking functions. (3 marks)
Show worked answer
(a) Predication is a reasonable basis to believe fraud has occurred or will occur; it must exist before an investigation opens because investigating without it exposes the organisation to claims of harassment or defamation, and wastes investigative resources chasing an unfounded suspicion (4 marks).
(b) Any three of: identify who was responsible and how the scheme operated; quantify the loss suffered; gather evidence admissible in criminal, civil or disciplinary proceedings; support recovery of assets and prevention of recurrence (3 marks).
(c) The backward-looking function establishes what happened, for accountability and evidence; the forward-looking function uses what the investigation learns to inform control improvements that prevent recurrence, both must be balanced rather than treated as sequential afterthoughts (3 marks).