Internal Fraud Investigations: The Risk and Reward of Third Party Involvement

Editor’s Note: This article was originally published on CCI on Nov. 11, 2009.

When a company is faced with an internal fraud investigation, it has several options concerning which direction to take the investigation. When regulatory agencies and reporting requirements are at hand the choices are more limited, but in instances where there are no outside reporting pressures, at what point the company calls for reinforcements is clearly a decision that needs to be made.

During an internal fraud investigation, circumstances will dictate the effort needed to determine the extent of the fraud. Every situation is different, but two important considerations face every company during this process:

1. when to consider hiring an outside consulting firm; and,
2. when, or more importantly if, the company should report the fraud to law enforcement.

Running an investigation solely within the company structure has certain benefits. These benefits can be diminished as outside forces are called in and can practically disappear upon law enforcement involvement. As the company gets closer to making this decision and weighing the advantages and disadvantages that are present, it may soon see other benefits start to emerge.

In making the decision, perhaps the most important factor to consider is how the decision will impact the company’s control over: (a) the costs of the investigation; (b) the disclosure of facts uncovered by the investigation; and (c) the timing and manner in which the investigation will be conducted.

These considerations can be summarized as:

• Cost Control – financial and human resources
• Disclosure Control – regulatory and public disclosures
• Investigative Control – timing and objectivity

These control factors have an inverse relationship whereby gaining advantages in one area of control may cause disadvantages in another. Depending on the company’s ultimate objectives, having the correct balance within the control structure is the key to a successful internal fraud investigation.

The Internal Investigation

The size of the entity, its available resources and its ultimate goals dictate which route a company takes in making its decision to bring in outside resources. If, for example, the company merely wants to fire the employee, then all that may be necessary is a quick interview and ultimatum to the employee with no consulting firm or law enforcement involvement necessary. Though this may seem to be a quick end to a bad situation, it would not be the company’s best long-term interest.

According to the Association of Certified Fraud Examiners (“ACFE”) 2008 Report to the Nation, the typical length of fraud incidents reported lasted two years from inception to detection. So any fraud uncovered may just be the tip of the iceberg and merely dismissing the employee would leave several unanswered questions.

Additionally, the ACFE 2008 Report to the Nation continues to note in its study that, “Schemes that involved two or more individuals resulted in a median loss four times higher than the amount of schemes committed by a single perpetrator.” This fact alone highlights the need to get the full picture of any fraudulent event no matter how small it appears to be on the surface.

Internal Cost Control: An increasing number of companies have the internal resources with the credentials necessary to conduct their own internal investigations. Conducting the investigation from the general counsel’s office or the internal audit department may be a viable course of action without ever involving a consulting firm or law enforcement agency. According to the ACFE, over half of its members work in some capacity for a business entity. If the company is able to leverage its own personnel during the investigation, it can be completed in a more cost effective manner, thus keeping cost control in check.

Internal Disclosure Control: According to Managing the Business Risk of Fraud: A Practical Guide sponsored by the ACFE, the Institute of Internal Auditors and the American Institute of Certified Public Accountants, “Fraudulent acts can damage an organization’s reputation with customers, suppliers, and the capital markets.” The guide refers to this risk factor as reputation risk, and this risk alone makes it imperative for the company to monitor the disclosure control of its fraudulent events.

As there is no legal requirement for disclosure of these events , many companies choose not to report the event or the full extent of the fraud to law enforcement or to the general public. Once the company makes the conscious decision to bring in the government, the disclosure control is weakened. Thus, keeping a tight reign over disclosure control many times outweighs other control factors in making the decision to handle the investigation internally and not involving law enforcement.

Internal Investigative Control: By not involving a third party specialty firm or law enforcement entity, the company keeps a tighter grip on its investigative control as it has no outside influences to sway the investigation. These investigations are often done within the company’s internal audit department, which, as mentioned above, are beneficial in cost and disclosure control. However, using internal resources to conduct these types of investigations may, in fact, put pressure on investigative control due to the lack of objectivity, independence and conflict of interest issues.

Often, companies breed a sense of family and loyalty and internal resources assigned to investigate their own sometimes have difficulty in making tough choices when they see their co-workers being placed in jeopardy. This is often the point in the investigation where the company decides to seek the assistance of an outside consulting firm specializing in fraud related matters to get the full picture of the events surrounding the fraud.

The Consulting Firm

Many CPA firms and independent specialty consulting firms have dedicated subject matter experts in the fields of forensic accounting and internal fraud investigations. These types of firms are in the business to assist companies and their legal counsel in conducting internal fraud investigations that are uncovered or suspected. A company often realizes during its initial review of the facts and circumstances surrounding the fraud the need for experts to understand the full extent of the damage and the exposure to the company. In doing this, it will lose some of the control advantages it would have if conducting a purely internal investigation.

Consulting Cost Control: Consultants bring tested expertise and resources to bear on internal investigations. However, it has to be recognized that the value added services that come with the engagement of a consulting company come with a price-a price that is can vary widely. An investigation can cost in the tens of thousands of dollars at a minimum, with the potential to be much higher, putting additional stress on cost control.

Fraud investigations are an evolving process and, by their nature, it is difficult to predict the amount of work necessary to obtain sufficient evidence of wrongdoing. The consulting firm will provide an estimate of the costs associated with its investigation based on the known facts at the start of the engagement; however, as the investigation moves forward, unknown and uncontrollable variables can increase the risk of upward pressure on cost control.

Consulting Disclosure Control: When hiring a specialty consulting firm or other outside consultant for internal fraud matters, it is best to engage them through the company’s outside legal counsel or at a minimum supervised by an attorney in the General Counsel’s office. This ensures that the disclosure control of the investigation remains with the company. Confidentiality and non-disclosure agreements are standard practice among consulting firms and the companies that hire them, but going through the company’s outside counsel will ensure that the disclosure control is solid as the consulting firm’s work product will fall under the attorney-client privilege and the work product doctrine. As long as the investigation does not uncover any regulatory disclosure requirements, the use of a specialty consulting firm may actually strengthen the disclosure control of the investigation.

Consulting Investigative Control: With a specialty firm, what you lose in cost control you can potentially gain in investigative control. Forensic and investigative consulting firms have a depth of professional experience and multiple credentialed experts who have been conducting fraud and forensic accounting investigations for many years. They bring the specialized skill set and knowledge base to focus the investigation on areas that are prone to fraudulent activities. Interviewing and interrogation skills are beneficial in any fraud investigation, especially if the company suspects multiple participants.

The firm can handle manpower requirements to deploy teams of forensic accountants and investigators on short notice to many locations around the globe. These firms also possess the objectivity and independence to carry out the investigation on a non-biased factual basis. All these factors and working hand in hand with the company’s internal resources play a key role in enhancing the investigative control of the investigation.

Law Enforcement

The decision to contact law enforcement during any suspected fraudulent activity should not be taken lightly. As with engaging a consulting firm, there are advantages and distinct disadvantages in the three control factors that will affect the company’s investigatory path. Remember, what a company gives up in one control area, may be gained in other control areas.

Law Enforcement Cost Control: Making the decision to turn the investigation over to law enforcement will generally not place a lot of stress on the cost control of the investigation as the company will most likely not get an invoice from the FBI. With that said, in most instances it will not have a particular benefit in this area either. The amount of internal resources utilized after contacting law enforcement is going to be the same as if the company chose not to involve them. This is due to the fact that internal management will still need a full accounting of the events surrounding the fraud and a parallel investigation will most likely be conducted. Though cost control is for the most part unaffected by contacting law enforcement, the same cannot be said as it concerns disclosure and investigative control of the investigation.

Law Enforcement Disclosure Control: Perhaps the greatest disadvantage in contacting law enforcement is the loss of disclosure control. Once an arrest is made and any indictment or complaint has been unsealed by the court, the events of fraud become public record and are available for the world to see. As these events become public, the company’s reputation risk as discussed above with suppliers, customers and, if a public company, the investment community, could be put at risk. This is sometimes the deciding factor on whether to contact law enforcement in internal fraud investigations.

The loss of disclosure control is a serious issue for most companies, but in some cases a company will choose to forego disclosure control for a much bigger impact in the long run as it relates to fraud prevention. The fraud prevention effects of seeing an employee handcuffed on fraud charges and waltzed out the front door of the office building on the evening news is a major deterrent for any other company employees who may want to grab a cookie out of the cookie jar.

Law Enforcement Investigative Control: Once a company makes the decision to include law enforcement, it will surely lose some of its investigative control. Perhaps the most significant risk in this area is the time it takes to complete the investigation and the ability to get information from law enforcement during the investigation. Normally, law enforcement and prosecutors have numerous cases assigned to them and the pace of most investigations can last several months to a few years. These two factors together can create significant delay in conducting the investigation and is one way in which the company’s investigative control is diminished. Additionally, as the information obtained by law enforcement is normally obtained via the grand jury, grand jury material is confidential and in most circumstances will not be shared with the company.

Although independence can sometimes be a hindrance in internal investigations and have a negative impact on investigative control, the independence and objectivity of the law enforcement agent or officer that comes with government involvement is one factor that enhances investigative control.

Law enforcement also has the advantage of certain legal powers and process that the company and its consultants do not possess: the power of the grand jury to subpoena records. Upon having the case assigned, one of the first steps in the investigation would be to obtain the financial records of the suspected employee(s). Upon receipt of these documents, the tracing of the funds from the company to financial accounts and beyond would produce some very useful evidence. The company or the consulting firm would not be able to get these records without the employee’s cooperation or without filing its own civil litigation. These records could be essential in uncovering the full reach of the fraud and its participants.

Conclusion

Evaluating the control factor considerations concerning hiring an outside consulting firm or including law enforcement is essential to the success of internal fraud investigations. Each path the company takes puts pressure on different areas of the control structure. The financial and human resource elements of cost control, the regulatory and public disclosure control requirements and the timing and objectivity of the investigative control, all have inversely related elements that are crucial to the investigation.

The key to making the correct decision is knowing the risks and rewards associated with each control factor and balancing them in a manner that achieves the company’s ultimate objectives.