You may suspect that an employee has stolen from your company. But without evidence of a crime, you’ll have a hard time pursuing prosecution. So if you discover a fraud, first call your attorney. Then take immediate steps to preserve the evidence.

Safeguard paper documents

Place any hard documents related to the possible fraud in a safe location that’s accessible only to key people. The fewer who handle it, the better. Don’t make notes on any paper documents and, unless necessary, don’t let them be handled. Instead, make separate notations about when and where they were found and how you preserved them. A court case can be derailed if you don’t preserve the chain of evidence and can’t prove to a judge’s satisfaction that the documents haven’t been tampered with.

Handling paper documents is relatively easy as long as you approach the task with care. You can copy anything you need to continue operations and turn the originals over to a fraud expert or law enforcement for fingerprinting, handwriting analysis or other forensic testing.

Take care with technology

Digital evidence can be another story, especially if your IT staff isn’t trained to react to fraud incidents. Even if these employees are highly skilled at setting up and troubleshooting your computer applications, they’re unlikely to be fully aware of the legal ramifications of having a computer or mobile device used to commit fraud.

IT staffers could inadvertently alter or destroy evidence in the course of restoring a computer to normal operations. To avoid such mishaps, arrange for training so that these employees know how to respond to fraud incidents. They should be instructed to stop any routine data destruction immediately. If your system periodically deletes certain information; including emails; that process must be discontinued the minute you notify them that something is amiss.

If no one has a background in computer forensics, turn the investigation over to an expert as soon as possible. Forensic experts can identify and restore deleted and altered records, digital forgeries and files that have been intentionally corrupted. They also can access many password-protected files and pinpoint unauthorized system access.

Be prepared

If you’re unsure about how to handle fraud evidence, simply take steps to restrict access to it, then ask your attorney about the next step.

(This is Blog Post #703)