Prevention is the heart of any fraud mitigation program. But sometimes even solid internal controls fail (because, for example, a manager overrides controls) and occupational fraud occurs. If you suspect an employee of stealing, you’ll want to do everything you can to ensure the perpetrator is caught.

In most cases, you should hand a fraud investigation over to your attorney and a forensic accounting expert. But before these professionals arrive on the scene, you may need to collect and secure evidence.

Paper evidence is generally easy

Handling paper documents is relatively easy as long as you approach the task with care. Place any hard documents related to the possible fraud in a secure location. The fewer people who touch it, the better. Don’t make notes on paper documents. Instead, make separate notations about when and where they were found and how you preserved them. You can copy anything you need to continue operations and turn the originals over to your advisors or law enforcement for fingerprinting, handwriting analysis or other forensic testing.

Remember, a court case can be derailed if you don’t preserve the chain of evidence and can’t prove to a judge’s satisfaction that documents haven’t been tampered with.

Digital files are more difficult

Digital evidence generally presents more challenges, especially if your IT staff isn’t trained to react to fraud incidents. Even if these employees are highly skilled at setting up and troubleshooting computer applications, they’re unlikely to be fully aware of the legal ramifications of having a computer or mobile device used to commit fraud.

To avoid the inadvertent destruction or alteration of evidence, arrange for training so that IT employees know how to respond when fraud is suspected. They should be instructed to stop any routine data destruction immediately. If your system periodically deletes certain information — including emails — that process must be discontinued the minute you notify them that something is amiss.

If no one in your organization has a background in computer forensics, immediately turn the investigation over to an expert. Forensic experts can identify and restore deleted and altered records, digital forgeries and files that have been intentionally corrupted. They also can access many password-protected files and pinpoint unauthorized system access.

Quick reaction

You need to react quickly when a possible fraud incident comes to your attention. Any delays may enable the perpetrator to destroy or remove evidence — which will make the incident harder for the experts to investigate.

(This is Blog Post #1160)