A basic use of forensic accounting skills can enable an organization to take the proper first steps in the event of a suspected fraud. You should also have a clear idea regarding the appropriate time to engage a forensic accounting specialist to preserve evidence for law enforcement. Fraud is a possibility in almost any company and a prudent executive will ensure that fundamental early planning is performed so that a per-arranged sequence of events goes into effect when a possible fraudulent event has occurred.

Employee Fraud is a major Forensic Accounting problem. The motivation for fraud as explained by the fraud triangle often explains the pieces that are usually in place when fraud occurs:

1. Pressure. The employee has encountered financial pressure from some source. This source could be medical bills, a drug problem, a gambling addiction or many other scenarios causing significant financial difficulty. The employee often views their theft as a loan that will be paid back as soon as the financial crisis is over.
2. Rationalization. Here the employee dredges up some real or imagined past wrong justifying their action. The employee could believe he or she was cheated in some way when a promotion or a raise was given to some other person.
3. Opportunity. This is the only element which you, as the financial executive can control and where the knowledge of how internal systems work and how those systems can be bypassed, come into play. Good internal control is one way to mitigate the opportunity to steal. Proper segregation of duties, no management overrides of the control system, dual-employee interaction at critical control points counting cash, bank reconciliation preparation and review, etc. are examples of how internal control can reduce the opportunity to commit fraud.

Insider fraud by an employee is a very common form of fraud, often committed by the very employee that has been given considerable trust over the years. Such an employee usually knows which parts of the control system are vulnerable and can, therefore, exploit those vulnerabilities. When a fraud is suspected, assume that the employee could have evidence on his or her computer. Separate the employee from the computer immediately and do not shut down the computer. Instead, pull the plug from the back of the computer. During the shutdown process, many files are changed. A talented litigator can make the case for tainted evidence if these simple issues are not performed in the correct order. If the suspect’s computer is running, it is best to leave the computer on until a forensic accountant can be brought in to assess the problem. Try to photograph the screen to document the programs running at the time.

Technology is a great enabler of fraud so be sure that your forensic accountant is skilled not only in overall forensic theory, but also in the technology of fraud. It is critical to maintain evidence of the suspected crime and very easy to obliterate it by taking the wrong steps with a computer system. The chain of evidence is very important. Make sure that all evidence that can be used at trial is handled without any tampering. If the employee has a company-provided cell phone, confiscate it immediately before data can be removed. Today’s smartphones are capable of enormous data storage, so consider the cell phone to be as much a source of evidence as a desktop or laptop computer.

During forensic accounting, you need to consider how much data is stored electronically in your organization. How do you track and organize the data so that it can be recovered in a meaningful way? Data even exists on your systems about your data this type of information is called metadata. In many corporate environments, data exists not only on one employee’s personal computer , but on a server or multiple servers. Advances in cloud technology, with data stored at offsite locations across town or across the world, can serve to complicate forensic efforts necessary to retrieve relevant information, such as files with critical information that log access attempts, file modifications, deleted files and more are stored on both local PCs and on servers. Forensic accountants use this type of data to investigate deeper into the transactions performed constantly within a company’s systems. Retrieval of specific information over a far flung array of computers, smartphones and servers can be a daunting task, especially when knowledge of accounting theory is required to determine data relevance.

A forensic accountant will usually ask to see the corporate data-retention policy so that he or she can be aware of the limitations of any data inquiries. Information should be stored in accordance with a corporate data-retention policy.

Knowing when to engage a skilled professional to resolve matters involving significant loss of money can be a critical decision. Often, the obvious loss is only the tip of an iceberg. Depending on how long a potential embezzlement may have occurred, enough funds could have been stolen to bankrupt a company. Prompt action in employing a properly credentialed forensic accounting professional can save thousands of dollars, often much more than you would pay for the professional service.