From suspicion to evidence — mastering the investigation process

Although this is a real case drawn from field experience, the names and locations have been altered to protect confidentiality. Any similarities to actual persons or offices are purely coincidental. What matters is the method of how a young, determined internal auditor turned suspicion into evidence, and unearthed a ghost scheme that cost taxpayers millions.

It began with a subtle red flag. During her quarterly review at a district health office in eastern Uganda, the internal auditor noticed an odd pattern. One supplier Green Mango Supplies Ltd had been paid UGX 76 million over just three months. Oddly, she had never seen any trucks offloading goods from them. No one in the store’s department had signed a delivery report. Yet, the payment had sailed through.

Her instincts kicked in.

Suspicion is not enough.

Most fraud investigations fail not because the suspects are smart, but because the investigators are sloppy. Suspicion is loud. The evidence is quiet. Many internal auditors shout about fraud, but when asked for proof, they mumble. And that is how cases die.

The curious payment at a district health office

In 2010, a young lady in her mid-20s came to our office with a case involving ghost suppliers. She was an internal auditor at a district in eastern Uganda. During her routine review of quarterly releases, she noticed that a company called “Green Mango Supplies Ltd” had been paid UGX 76 million for supplying non-pharmaceutical items.

Her suspicion? She had never seen a delivery from them.

Following the money — how it was done

(i) The company was registered in the name of a cousin to the district procurement officer.

(ii) Payments were processed using fake Local Purchase Orders (LPOs) generated during system downtimes. These were approved manually with forged signatures.

(iii) The delivery notes bore stamps from the store’s department. Upon scrutiny, the stamps were traced back to a stolen pad from the sub-county headquarters.

(iv) Once payment was wired, the money was withdrawn in cash across four transactions, each just under the threshold requiring second approval UGX 19 million, 18.5 million, 20 million, and 18.5 million.

How the auditor nailed it

(i) She retrieved the original LPOs and noted inconsistent fonts and date formats.

(ii) She visited the supplier’s address. It led to a kiosk selling sugar.

(iii) She requested CCTV footage from the bank. The man withdrawing the funds was the cousin, not a company representative.

(iv) She flagged the audit report with these findings and submitted it to her seniors.

The suspects were arrested. But here is the sad twist only UGX 4 million was recovered. The rest was long gone.

Lessons in investigation

Do not chase ghosts. Chase transactions. The red flags are always altered documents, unusual approvals, cash withdrawals, or too-quick payments. Always start from the system, then trace backward.

Evidence is found in contradictions. If the paperwork says goods were delivered, but there is no space in the store or acknowledgment from users, that’s your first breadcrumb.

From suspicion to evidence, the journey requires discipline, not drama. Investigations fail not due to a lack of leads, but because many lack the patience to follow the money. In this case, UGX 76 million vanished, but the real loss was public trust.

Investigate with precision. Document everything. And never assume anything. As I always say, strategy is in the details.

Unlock your investigative skills and become a reporting pro: Sign up today for our Investigation and Report Writing Course and start making an impact!