Fraud isn’t solely the realm of finance teams and accountants. Insider—or occupational—fraud spans all departments, making a whole-of-organization approach to detection all the more essential.
This is because the longer occupational fraud goes undetected, the larger the losses tend to be for the targeted organization. Fraud schemes that were undetected for five years or more caused median losses of $875,000, compared to just $30,000 in median losses for schemes that lasted less than six months, according to a biannual report from the Association of Certified Fraud Examiners (ACFE).
Globally, between January 2022 and September 2023, occupational fraudsters caused total losses of more than $3.1 billion, the ACFE found in its Occupational Fraud 2024: A Report to the Nations. The report examined 1,921 occupational fraud cases from 138 countries and territories, finding that the average loss per case is $1.7 million. Based on its research beginning in 1996, the ACFE estimates that organizations lose 5 percent of their revenue each year to fraud.
“What we have learned is that occupational fraud is very likely the largest and most costly form of financial crime in the world, with estimated annual costs in the trillions of dollars,” wrote John Warren, CFE, CEO of the ACFE, in this year’s report. “These crimes are a threat to every type of organization in all industries in every region throughout the world.”
While many might associate fraud with the world of accounting, security teams play an important role in fraud prevention, detection, and mitigation. This is most clearly seen in the work that investigators do when a tip comes in where suspicious activity—including fraud—is occurring, says Mason Wilder, CFE, research director for the ACFE.
[embedded content]
Tipline Awareness
Tiplines or hotlines are important because nearly half of all reported fraud investigations—43 percent—begin with a tip to a reporting hotline, according to the ACFE.
This tipline, sometimes a regulatory requirement for organizations, can be a Web, telephone, text message, or email-based solution. The ACFE has found that organizations that provide several tipline channels are seen as having a more effective tipline program than others.
Whatever mechanism an organization chooses, it is critical to make employees, vendors, and customers aware that the tipline exists and that they are empowered to use it to report fraud and other security concerns, says Carlos Galvez, Jr., CPP, principal risk consultant at Bastion Projects and a member of the ASIS International Banking and Finance Community Steering Committee.
“In my experience, [tiplines] worked as the mechanism of detection or of notification to the organization that something’s wrong,” Galvez says, adding this is especially true for organizations that may lack robust internal controls or be operating in complex environment.
For instance, a company with thousands of customers and sales team members might have a difficult time identifying and detecting fraud as it occurs.
“My experience has been that those hotlines have led to some of the largest investigations that I’ve been involved in,” Galvez says. “It’s because I think people feel more inclined to report something when they know, or when they have the ability to do so anonymously or in a non-confrontational way.”
Tiplines also provide individuals with the opportunity to report not just actual fraudulent activity, but suspicions that something isn’t quite right that investigators should maybe take a look at.
“It just provides an additional avenue for detection,” Galvez says. “That’s very important because the folks that are using it are the ones that are on the front line. They’re the ones standing shoulder-to-shoulder with their coworkers in that bank branch or warehouse or sales office that’s halfway across the country or halfway around the world that leadership or security has very little visibility into.”
Clear delineation of who is responsible for handling the initial tip and escalating it, if necessary, to investigators also adds perceptions of a tipline’s credibility. Some organizations choose to have tips sent to an outside party, while others might handle them internally through an audit team.
5 percent
How much revenue organizations lose to fraud each year, according to ACFE estimates.
It’s also important to have policies and procedures in place for managers to report tips, since employees may not use the official tipline but might provide a tip to a manager or an HR representative. The ACFE found in its recent report that direct supervisors were the party that most whistleblowers reported to if they did not use a tipline mechanism (29 percent).
“Traditional non-tech or non-high-tech methods are important as well because you may have folks that feel much more comfortable picking up the phone and reporting something—or maybe even in person,” Galvez says.
As unlikely as it may seem to report fraud in person, Galvez says this has happened several times during his career, so it is important to make sure that “supervisors, managers, still create those spaces for employees to feel comfortable, to feel confident that they’re doing the right thing by reporting something in a one-on-one meeting.”
This can also foster a culture where employees feel empowered to report issues or concerning behavior not only to their supervisors, but to HR as well.
For instance, Scot Walker, PCI, chair of the ASIS International Investigations Community, recalls an incident where sales team members were taking clients to gentlemen’s clubs and creating their own receipts so they could be reimbursed for the unauthorized activity by their employer for the cost.
The company was tipped off to the activity and initiated an investigation when an employee told an HR colleague about the behavior and that he was uncomfortable about the activity.
“It was a whole team. We found the one weak link in the team, and we asked them, ‘How did you do this?’” Walker says, adding that they ultimately discovered that a vice president of sales had instructed team members on how to create fake receipts to carry out the scheme.
The key to people discussing their concerns about wrongdoing is creating a culture where people are encouraged to report suspicious activity without fear of retaliation.
“If employees have a sense that there’s a culture of retaliation, of people who report things all of a sudden being gone in a month or two, they’re never going to step up and report anything because their experience and beliefs are going to be based on what they’ve seen and experienced with other folks that have stepped up and reported something,” Galvez adds.
Assessing Tips
Whether the tip comes in via the tipline or a direct report to a supervisor, organizations then need to assess if the tip is credible and what the next steps should be.
Some organizations have an outside vendor that collects tips from the tipline, while other organizations will have human resources or their fraud department collect tips.
“Regardless of who is responsible, you first off need to make sure that you have policies in place to define who is responsible and how they should escalate credible allegations—and what the process is for that,” Wilder says.
This preliminary investigation is used to establish predication, or as Wilder describes it: “evidence or information that would lead a reasonable person to believe that fraud is occurring or has occurred.”
To start this process, Walker says he likes to begin with the source data—the email, text message, telephone audio, or Web form that provided the tip. This source data can provide the investigator with the tipster’s sense of urgency, empowerment, and what the tipster believes is the real issue at stake.
Walker says he prefers a tip that uses a form as its basis, since it often provides data he likes to have as an investigator—the who, what, when, where, why, and maybe even sometimes the how fraud is occurring.
But often, the information provided in the initial tip is limited. Walker shares the example of someone reporting via the tipline that a manager just purchased a new Ford F-150 truck (which starts at $38,710 in the United States) and the tipster is skeptical the manager can afford such a vehicle.
“Oftentimes, you don’t quite get enough to point you in the right direction because sure, we can go and start looking at things, pulling criminal histories, and looking at emails doing all those things,” Walker says. “But is it ethical to immediately believe everything we hear and go on what could be a very intrusive investigation? We have to weigh that based on the information.”
To aid in this analysis, Walker says he’ll use a checklist and discuss the tip with the assembled investigation team to evaluate the credibility of the tip. A key part of the process is often determining if the tip points to or identifies a specific person who is suspected of wrongdoing.
“Understanding who that person is and then what they’ve done is where I start,” Walker adds. If that information is clear, he immediately starts by checking to see if that individual is still employed at the organization.
But is it ethical to immediately believe everything we hear and go on what could be a very intrusive investigation?
Galvez adds that he also looks at the nature of the allegation to determine if such activity is even possible and if some easily accessible resources exist to check it.
For instance, someone might make a report that an employee is engaging in timecard fraud. The security department would likely have access to video surveillance at the location and could check to see if the employee in question was at the store when the reported timecard fraud occurred.
“If they are there, then as far as I’m concerned, that’s a very high-level way of closing that case out or pushing it to the bottom of the stack,” Galvez says. “If the person isn’t there, then it gets prioritized to something that needs to be investigated further. Just because the person isn’t right there on video right then doesn’t mean that time fraud was committed. There could be several reasons they’re not appearing on camera, so then it gets queued up for an investigator to look into further.”
More serious allegations, such as reports of chief financial officers embezzling from the company, can follow a similar process. Galvez adds, however, that any report about a C-level individual—including allegations of discrimination, harassment, or other illegal activity—needs to be investigated to its natural conclusion.
“When I say natural conclusion, it’s as far as the evidence or information that you have available to you leads you,” Galvez explains. “Beyond that, I think wanting to close something for the sake of closure absent that information, facts, and evidence, then I think you’re doing the organization a disservice of sorts because you’re prioritizing and focusing your time on something that is likely not going to result in any beneficial outcome to the organization.”
Handling the Investigation
Internal investigators’ work begins before an investigation even occurs. This is when investigators connect with their colleagues to build what Galvez calls “relationship capital,” ensuring that they have enough capital to “cash in” in certain situations.
“It’s not just specific to interviews and investigations, but I’m also very mindful of the fact that given my role and previous roles, I should say, that I could be put in a position where I have to interview someone I work closely with,” Galvez adds. “Always maintaining a separation between personal and professional relationships is important before you’re put in that position.”
Respectful interviews. When it comes to interviewing employees during a fraud investigation, Galvez says it’s important to treat individuals with care and respect. He learned this lesson from the book Prove ‘Em Innocent, which analyzed interviews and investigations from the viewpoint of proving someone innocent instead of proving someone guilty.
Galvez emphasizes that it’s important to look for a scope of information that would prove your potential theory or allegations that are being investigated, but also information that could exonerate an individual of wrongdoing.
Walker, who was previously an investigator in the U.S. military, also says it’s ideal to be able to conduct interviews in person to help create the sense that you, as the investigator, are on equal footing as the interviewee—especially if that individual is an executive.
“Overcoming those barriers is really important,” Walker says. “Treating them with the respect they’ve earned is incredibly important. This is where I think a lot of my former law enforcement partners get in trouble in an interview room, because they treat everybody like they’re a suspect and the different tactics that you can use—you can switch from an interview to an interrogation.”
But it’s important to remember that in the private sector, investigations are not interrogations. Individuals are free to leave at any time and can feel empowered to not speak to an internal investigator.
“You have to be careful how you apply pressure, and you have to be respectful with who you’re talking with because oftentimes, they do know a lot of people in the company and I’ve had that feeling that, if we go down this rabbit hole with somebody, are they going to feel attacked?” Walker says. “And is that going to be a problem for us in the future?”
Walker also suggests that when it comes to interviewing the person believed to be the perpetrator of a fraud scheme, investigators talk with their HR and legal colleagues to determine what the goal of this interaction is. Sometimes the goal is to get the individual to admit to their illicit activity; other times, the goal might be to provide the person with an out.
For instance, Walker says after collaborating with HR and legal he might provide off-ramps in the interview for an individual to save face with the organization.
“I can say things like, ‘Look, I know you didn’t intend for this to happen. Look, I know you have a child with some medical challenges and so you needed the funds for that,’” Walker explains.
It’s also critical to maintain professionalism through keeping people informed about the progress of the investigation and by following investigative best practices, such as standards published by ASIS International, he says.
Taking this approach, Galvez adds, has led to an investigative process where people felt respected regardless of the outcome.
“I think if you’re very deliberate about being respectful, caring, and professional through the process, and you explain to people what you’re doing and why you’re doing it, I think a lot of folks—even if they’re for the lack of a better phrase the target of the investigation—they’re still going to understand that you’re carrying out your responsibilities and your job duties that you’re there to do, and not take it personally,” Galvez says.
Appropriate scope. In some instances, an investigation may be limited in scope and does not advance. But Galvez says investigators should note that a report was made and how that report was handled in case a similar report is made in the future. This will allow investigators to potentially tie similar reports together to identify trends or patterns.
It’s also important for internal investigators to weigh if they have the bandwidth and resources to carry out an investigation in a timely manner. Galvez says he often asks himself what the priority is for the report, if he has the internal capability and bandwidth to investigate it, and if not, what external resources he has a relationship with that he can reach out to for assistance. Often, security departments have the right to reach out to consultants for help in conducting a timely investigation.
“That becomes much more important if you’re operating in a regulatory environment, meaning depending on whatever the report is, if it is under any of the regulatory requirements that your organization is responsible for or accountable to, you’ve got to make sure that you’re dealing with those things in a timely manner,” Galvez adds.
The dynamic of an investigation might also change if it’s focused on an executive. These types of investigations will require working with legal counsel, either internal or external, because there will be privileged information involved in the results of the investigation. Organizations may also assess how to handle the investigation depending on the financial calendar and whether the organization is required to disclose the investigation to regulators.
Moving forward requires interacting with the communications team (to be prepared to respond to internal and external questions about the investigation), legal counsel, and executives on the board of directors who are not involved or implicated in the allegations, Galvez says.
Outside validation. As part of this process, the organization may hire an external investigator to conduct an investigation to verify the information that was uncovered, says Sandra Stibbards, president of Camelot Investigations and vice chair of the ASIS Investigations Community. This is especially common when investigating allegations against a C-level individual.
“When you’re talking about somebody that might be running the company or one of the top people that run the company and make everything happen…every single item that I am looking at is going to be double- and triple-verified to make sure it’s accurate,” Stibbards says. “That way, when they take this to court—because they will take this to court most of the time—I don’t have to testify because I will have given them every resource and every identifier and place I’ve gotten any record of showing the nefarious activity.”
Stibbards says she demonstrates that level of verification by writing “meticulous” reports that cite each source, such as interviews, exact links to online activity, and other reference points.
“If I find a picture on Facebook, I’m actually going to copy and paste that URL from Facebook for that post, put it into my report, then I’m going to explain what they’re looking at, and then I’ll give a screenshot just to make it look pretty so they know what they’re seeing,” Stibbards adds. “That URL is everything, because if they don’t have that, it means nothing. You can use Photoshop, you can change names, but the URL can’t be changed, even if the item has been taken down.”
Handling the Conclusion
Sometimes, an investigation might be inconclusive. It’s important that investigators make other organizational stakeholders aware at the outset that this could occur.
“Sometimes there isn’t enough information in the allegation that’s being made or the results of your investigation into that allegation is inconclusive,” Galvez says. “I think sometimes either the business unit, executives, HR, legal, or even the investigators at some point are not satisfied with that result because you want some sort of closure, but you’re not always going to get it.”
In other instances, the investigation might determine that wrongdoing may have occurred but it’s not clear at the natural conclusion who was responsible.
“Instead of continuing to spin your wheels, if there’s nothing else that you can find that’s going to help you determine if the allegation is true or false, then you need to settle for it’s an inconclusive investigation,” Galvez says. “That doesn’t mean nothing happens. If the allegation is, for example, someone is embezzling money from this particular program, then you go and you do some assessments, you look for vulnerabilities, you look for gaps and control measures, and you take some corrective actions to prevent it from happening in the future.”
In other cases, it might be clear who engaged in wrongdoing, but that organization determines that person should continue to be employed. In the ACFE’s 2024 report, for instance, some survey respondents said that fraud perpetrators received probation or suspension (11 percent) or were not punished (5 percent). Sixty-seven percent of survey respondents said perpetrators were terminated, with 9 percent allowed or required to resign.
“As an investigator, not everything you investigate is going to lead to someone being separated or arrested,” Galvez says. “In some cases, you may conduct an interview and investigation of somebody you maybe on a regular basis work closely with and will have to continue to work closely with after that interview and investigation is over.”
Having the emotional intelligence and ability to continue that professional relationship is an important skill set for investigators to have, Galvez adds.
As an investigator, not everything you investigate is going to lead to someone being separated or arrested.
In other instances, an organization might decide that an employee who engaged in fraud should be fired but doesn’t want to take additional punitive action.
“In the private sector, there’s very much a grey area,” Walker says. “Very few companies exist to put people in jail. The company ultimately just wants to offload the bad vibes and get that person out of the company as quickly as possible, mitigate the damage, mitigate the risk, and then try and save some face themselves in the process. That’s what we have to navigate as investigators.”
And yet, in some cases, investigators will determine an employee engaged in wrongdoing. The organization may then decide that that person should be fired, and the employer may work with law enforcement to attempt to have that individual prosecuted.
“As an internal investigator, there are lines. There are the immoral, unethical, and illegal lines that are not crossed,” Galvez says. “Outside of those, it’s really depending on the organization and what they want to do.
“I think more and more organizations are realizing that sweeping these things under the rug, or looking the other way, or not taking some action is not in their best interest, regardless of what the immediate impact is going to be to their stock price, to their reputation, to their brand,” he continues.
The ACFE assessed that in occupational fraud cases that resulted in criminal referrals (57 percent of cases), there was a 72 percent success rate (45 percent pled guilty and 27 percent were convicted at trial).
From what Galvez has seen during his 27-year career as an investigator, the “larger the dollar amount, the more likely an organization is to go seek that prosecution and refer a case to an outside law enforcement agency.”
Whenever there’s a possibility that a criminal prosecution might be down the road, Galvez says internal investigators should attempt to hand over the case on a “silver platter” so there is “very little that they can push back on” to determine how the person violated the law.
This means writing reports that lay out what the elements of embezzlement are, for instance, and how those elements have been met.
Ultimately, it will be up to prosecutors to decide whether to take the case. Galvez says having a relationship with the local jurisdiction’s financial crimes unit—or even the FBI’s White Collar Crimes unit—may help with this. Attempting to have the individual prosecuted may also prevent him or her from engaging in wrongdoing at their next employer.
“Especially for certain industries if that individual goes held unaccountable for whatever they did at your employer or your place of business, a lot of times what we see is they just go on to the next place and commit that same level of crime—or even become emboldened and step it up and take additional risks, maybe the amount of funds or whatever it is they’re doing increases,” Galvez says.
But it’s also important to set expectations with stakeholders that the district attorney may not press charges against the individual and make it clear to the team that it’s not a reflection of the quality of the investigation or investigators’ work.
“Because a lot of times I can tell you personally, I’ve felt that it’s a reflection of our work or my team’s work of how well we conducted our investigation,” Galvez says. “Did we provide everything that was needed to make this case that a public agency would want to prosecute?
“A lot of times it has nothing to do with that. It has everything to do with bandwidth and then the calculation that’s taken on by that agency to decide, ‘Are we likely to get a conviction here or not?’” Galvez continues. “It has nothing to do with the skill set or the work that was conducted, or the work product of the internal investigations team.”
If the case isn’t taken up for prosecution, that’s not always the end of the road. Investigators can go back and see if there’s additional information—or even new information—that could be added to bolster the case and present it again.
“The position I’ve always taken is that it’s not a private security team or internal investigator’s objective to prosecute, arrest, and find guilty,” Galvez says. “Our objective is to minimize losses and learn from those losses and ensure that they’re not repeated within a private organization. Prosecution in some cases is a nice outcome but shouldn’t necessarily be the main objective of an internal investigative team.”
Megan Gates is senior editor at Security Management. Connect with her at [email protected] or on LinkedIn.