Corporate Fraud Investigation – Series 1

A Tailored Investigative Approach

Why does every corporate fraud investigation require a different investigative approach ?

Because an investigator must understand the case, determine the direction of the investigation, select the appropriate methods, test indications, conduct verification, and exercise sound investigative judgment.

Understanding the Complexity of Corporate Fraud

In a corporate fraud investigation, the first question is not always:
“Who did it?”
Often, a far more important question is:

“What is actually happening?”

A transaction may appear unusual. A manager may begin displaying a different pattern of behaviour. A business decision may consistently benefit a particular party. A vendor may continue receiving business despite the availability of other alternatives. Or there may be discrepancies between what is recorded in the documents and what is actually occurring in the field.

All of these may constitute indications.

But an indication is not a conclusion.
This is where corporate fraud investigation begins to require a different investigative approach.

No Two Cases Are Exactly the Same

At the initial stage, many suspected fraud cases appear relatively simple.
A company may have information indicating that funds are missing and that one individual is suspected of being responsible.
However, an investigator cannot simply stop there.
The next questions immediately arise:

• Who had access ?
• Who provided the approval ?
• Who knew about the transaction ?
• Who benefited from it ?
• Was this an isolated event ?
• Or does it form part of a pattern that continued for months or even years ?

As these questions are pursued, the initial picture often changes.
A subject who initially appears to be the only individual requiring attention may turn out to have close relationships with several other individuals.

A transaction that initially appears to be an isolated event may reveal a broader pattern. Activities initially dismissed as administrative errors may begin to indicate something different when compared against other information.

This is why every corporate fraud investigation requires a tailored approach.

The Company Defines the Investigative Environment

The investigation takes place within a corporate environment shaped by its culture, organizational structure, business processes, and people—each with different characteristics and dynamics.

An investigation within a small family-owned company will inevitably have different dynamics from one conducted within a large family-owned enterprise.

The same applies to companies with professional management, branch offices, extensive vendor networks,
business partners, or operations across multiple jurisdictions.
A formal organizational structure may provide an initial framework.
But the investigator must also understand the unwritten structure.

• Who do people actually turn to for answers ?
• Who has influence ?
• Who is trusted ?
• Who is consistently involved before certain decisions are made ?
  

This is where the distinction between formal structure and informal relationships becomes relevant.

A Subject Is Not Always What They Appear to Be

One of the greatest challenges in corporate fraud investigation is understanding the subject.
A person’s job title provides only part of the picture.

• An individual may appear to be an ordinary staff member but have a very close relationship with senior management.
• A manager may have limited formal authority but significant influence over particular decisions.
• A shareholder may have little involvement in day-to-day operations but maintain extensive business relationships with certain internal and external parties.

Therefore, an investigator must understand a subject through multiple factors:

• Position
• Access
• Authority
• Influence
• Relationships
• Activity Patterns

The purpose is not to immediately conclude that an individual is involved.
The purpose is to determine what questions should be asked next.

Indications Can Shape the Investigative Strategy

A sound investigation begins with available information, but it must not be controlled by the initial assumption.
For example, a payment to a particular vendor may be identified.
The question is not simply : “Is this payment suspicious?”

The investigator must develop the indication by asking:

• Who selected the vendor ?
• Who approved the quotation and payment ?
• How was the vendor selected ?
• Is there a close relationship between the vendor and any employee or member of management ?
• Are the price and transaction terms consistent with normal business processes ?
• Has the vendor been used previously ?
• Has the vendor received any special priority or exception ?
• Are payments to this vendor consistently processed faster than others ?
• Are there other transactions exhibiting the same pattern ?

Each answer may generate another question. And each new question may open a different investigative direction.

Looking for Patterns, Not Merely Errors

Fraud is often not visible in a single event.
A pattern may emerge from a collection of information and activities that appear normal when viewed individually.
A single transaction may not carry significant meaning. But when compared against other transactions, time periods, individuals involved, and relationships between parties, a pattern may emerge that requires further examination.

Therefore, an investigator must be capable of identifying the relationship between:

People → Process → Transactions → Relationships → Patterns

The objective is not to find evidence that confirms the initial suspicion. Quite the opposite. The investigator must remain prepared to discover that the initial hypothesis may be: correct, partially correct, or completely incorrect.

A TAILORED INVESTIGATIVE STRATEGY

Because every case has different characteristics, investigative methods cannot be selected automatically. In one case, document analysis and transaction analysis may be the most relevant starting points. In another,
a background investigation may be required.
Under certain circumstances, field investigation or surveillance may become relevant. And in highly specific
situations, an undercover investigation may be considered.

The selection of investigative methods must be driven by objectivity and investigative requirements—not the other way around. An investigator should not force a particular method simply because it worked in a previous case. What worked for Company A may not work for Company B.

When available intelligence is insufficient, OSINT (Open-Source Intelligence) may help identify information from publicly available sources. Other intelligence-led approaches may also assist in understanding relationships, backgrounds, or other relevant information.
However, information still requires verification. Information does not become fact simply because it appears convincing.

In a professional investigation, information must be compared against other sources, placed within its proper context, and tested against the facts available.
If questions remain unanswered after these approaches have been applied, the investigative strategy may need to evolve.

Under certain circumstances, that requirement may lead to a covert approach.
However, such a decision must be made carefully, based on objectivity, risk, proportionality, and the specific
information requirement.

THE STRATEGY CAN CHANGE DURING THE INVESTIGATION

One of the common mistakes in an investigation is assuming that the strategy established on the first day must remain unchanged until the investigation is completed.

Corporate fraud investigations are dynamic.

• New information may change the investigative hypothesis.
• Additional subjects may emerge.
• New relationships may be identified.
• Transaction patterns may point in a different direction.

For this reason, the investigator must conduct continuous and dynamic assessment, allowing the strategy to evolve. The investigation may require the strategy to be:

• Expanded.
• Narrowed.

The strategy may even need to be discontinued when the initial indications cannot be substantiated after
verification.

The ability to change direction is not a sign that an investigation has failed. It is an essential part of sound and dynamic investigative judgment.

WHY IS INVESTIGATIVE ADAPTATION IMPORTANT?

Investigative adaptation is ultimately not simply about selecting a different method.
It is a way of thinking.
An investigator must understand that:

• Every company is different.
• Every subject is different.
• Every relationship is different.
• Every indication is different.

Therefore, every investigation requires a dynamic strategy that is specifically tailored to the circumstances of the case.

An investigation begins with questions, not conclusions. Information is gathered to build understanding. Hypotheses are developed to be tested. And the strategy is adjusted according to the facts that emerge.

From Indication to Investigative Strategy

When addressing the detection and investigation of corporate fraud, we believe that an investigative strategy must be built around the actual characteristics of the case, rather than merely around the initial suspicion.
The scale of the company, business processes, position of the subject, internal relationships, business environment,

initial information, and level of access may all determine the complexity of an investigation.
The investigative process may therefore develop through:

Indication → Questioning → Observation → Analysis → Hypothesis → Verification → Strategy

This process is not designed merely to identify a person who is suspected of wrongdoing.
The objective is to understand:

• What happened.
• How it happened.
• Who may have been involved.
• How the relationships between the parties were formed.
• Whether the activity is still ongoing.

Every subject is different. Every case is different, And every investigation requires a strategy designed specifically for the circumstances of that case.