Capstone: fraud risk management, whistleblowing and the investigation report

This final lesson brings the Saltmarsh Industrial Supply Ltd. investigation to a close and steps back to the question every board asks afterwards: how do we stop this from happening again? It covers the reconstruction of the case timeline, the structure of the investigation report, fraud risk management frameworks, whistleblowing programs and the protections for whistleblowers in each country, and the remediation plan that Saltmarsh Industrial Supply Ltd. adopts. It also draws together the course's main lessons about the forensic accountant's role.

Reconstructing the timeline

A chronology is one of the most useful tools in any investigation. Placing documents, data and statements on a single timeline reveals sequences that no single source shows, highlights gaps, and exposes contradictions between what people said and what records show. Chronologies are built throughout the investigation and are often attached to the report. The program below sorts a selection of events from the Northfield workstream.

# Reconstructing a timeline from documents and interview notes (invented events).
# Sorting sources by date exposes gaps and contradictions to raise in the next interview.
events = [
    ("2026-03-12", "interview", "Calloway says he never met anyone from Northfield"),
    ("2022-03-28", "vendor master", "Northfield created; request entered under Calloway's user ID"),
    ("2022-03-21", "corporate registry", "Northfield registered; director G. Pellerin, 14 Ferncliff Drive"),
    ("2026-01-29", "email", "Calloway asks AP clerk to hold Northfield invoices during the audit"),
    ("2022-04-14", "payment", "first Northfield payment, 4,605"),
    ("2026-02-20", "hotline", "report H-26-006: logistics invoices with no matching delivery"),
    ("2018-05-02", "HR file", "Calloway lists G. Pellerin at 14 Ferncliff Drive as emergency contact"),
    ("2026-03-19", "interview", "Pellerin says Calloway set up the company and handles its bank card"),
]
prev = None
for d, src, what in sorted(events):
    gap = ""
    if prev:
        y1, m1, _ = map(int, prev.split("-")); y2, m2, _ = map(int, d.split("-"))
        months = (y2 - y1) * 12 + (m2 - m1)
        gap = f"(+{months} mo)" if months >= 6 else ""
    print(f"{d}  {src:<19}{what} {gap}")
    prev = d
claims = [e for e in events if e[1] == "interview"]
print(f"\nInterview statements to test against documents: {len(claims)}")

2018-05-02  HR file            Calloway lists G. Pellerin at 14 Ferncliff Drive as emergency contact 
2022-03-21  corporate registry Northfield registered; director G. Pellerin, 14 Ferncliff Drive (+46 mo)
2022-03-28  vendor master      Northfield created; request entered under Calloway's user ID 
2022-04-14  payment            first Northfield payment, 4,605 
2026-01-29  email              Calloway asks AP clerk to hold Northfield invoices during the audit (+45 mo)
2026-02-20  hotline            report H-26-006: logistics invoices with no matching delivery 
2026-03-12  interview          Calloway says he never met anyone from Northfield 
2026-03-19  interview          Pellerin says Calloway set up the company and handles its bank card 

Interview statements to test against documents: 2

The chronology shows that Calloway had listed G. Pellerin at 14 Ferncliff Drive as his emergency contact almost four years before Northfield was registered at that address, that the vendor was created under Calloway's user ID a week after registration, and that the first payment followed two weeks later. It also places his request to hold Northfield invoices during the audit a month before the hotline report, and shows that his statement that he never met anyone from Northfield is contradicted by his own HR file and by Pellerin's account a week later. The forensic accountant reports these facts and contradictions; whether they show dishonesty is for the court in the civil action.

The outcome of the Saltmarsh Industrial Supply Ltd. investigation

Corbett Lane Forensic LLP delivers its report to outside counsel in June 2026. Its principal findings, summarized here from the invented case, are as follows.

After receiving the report, the company acts on its own decisions, informed by counsel. It ends R. Calloway's employment and continues its civil claim against him and Pellerin, supported by a freezing order obtained in April 2026; it files a proof of loss with Harrow Mutual Insurance; and it gives the police a copy of the evidence they request. It restates its fiscal 2025 financial statements with Pryce Dunmore LLP, informs its lenders and obtains a covenant waiver, and the board ends C. Varga's employment; Varga disputes the board's conclusions and has started a wrongful dismissal claim, which the company is defending. The Keel and Rudder matter leads to a recovery demand and a new conflict-of-interest declaration process. None of these decisions are made by the forensic accountants, whose role is to establish the facts.

Writing the investigation report

Investigation reports vary with the forum and audience, but good reports share a structure and a tone. They are written for readers who may not be accountants, who will rely on the report to make decisions, and who may be opposing parties looking for weaknesses.

Findings should be stated as facts with sources: "The vendor record was created on March 28, 2022 under user ID RCALLOWAY (document 14)", not "Calloway created a fake vendor". Opinions within the forensic accountant's expertise, such as the amount of a loss, are clearly identified as opinions with reasons. Conclusions about intent, credibility or guilt are left to the trier of fact. Exculpatory evidence, explanations offered by the subject and matters that could not be resolved are reported alongside the evidence that supports the allegations. Before the report is issued, a second senior professional reviews it against the evidence, often line by line. These habits make reports more persuasive, not less, because a reader who sees that the investigator considered every side is more likely to accept the findings.

Fraud risk management

Investigations deal with fraud after it happens; fraud risk management aims to prevent it and to detect it early. The most widely used framework is the Fraud Risk Management Guide published jointly by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) and the ACFE, whose second edition appeared in 2023. It is built on five principles aligned with the COSO internal control framework: fraud risk governance, in which the board and senior management set expectations and assign responsibility; fraud risk assessment, which identifies specific schemes and the risks of each; fraud control activities, preventive and detective, including data analytics; fraud investigation and corrective action, with a process for reports, investigations and consequences; and fraud risk management monitoring, which evaluates whether the program works and improves it.

A fraud risk assessment considers how each scheme could occur in the organization, how likely it is, how much harm it could do, which controls address it and how well, and what residual risk remains. It should involve people who understand the processes and should include management override as a risk in its own right. Saltmarsh Industrial Supply Ltd.'s audit committee asks Corbett Lane Forensic LLP to facilitate a fraud risk assessment as part of the remediation. The program below scores six schemes before and after the planned remediation, using the team's assessments of likelihood, impact and control effectiveness.

# Fraud risk assessment for Saltmarsh after the investigation (invented ratings, 1 to 5 scales).
# Inherent score = likelihood x impact; residual applies the assessed effectiveness of controls.
risks = [  # (scheme, likelihood, impact, control effectiveness 0-1 before, after remediation)
    ("Fictitious vendor billing",           4, 4, 0.20, 0.75),
    ("Revenue cutoff and side agreements",  3, 5, 0.30, 0.70),
    ("Expense reimbursement abuse",         4, 2, 0.40, 0.70),
    ("Payroll: ghost or terminated staff",  2, 3, 0.50, 0.80),
    ("Supplier kickbacks in purchasing",    3, 4, 0.25, 0.60),
    ("Payment redirection by email fraud",  4, 4, 0.35, 0.85),
]
print(f"{'Scheme':<38}{'inherent':>9}{'residual before':>17}{'residual after':>16}")
for name, l, i, before, after in sorted(risks, key=lambda r: -(r[1] * r[2] * (1 - r[3]))):
    inh = l * i
    print(f"{name:<38}{inh:>9}{inh * (1 - before):>17.1f}{inh * (1 - after):>16.1f}")
tb = sum(l * i * (1 - b) for _, l, i, b, _ in risks)
ta = sum(l * i * (1 - a) for _, l, i, _, a in risks)
print(f"\nTotal residual score: {tb:.1f} before remediation, {ta:.1f} after")

Scheme                                 inherent  residual before  residual after
Fictitious vendor billing                    16             12.8             4.0
Revenue cutoff and side agreements           15             10.5             4.5
Payment redirection by email fraud           16             10.4             2.4
Supplier kickbacks in purchasing             12              9.0             4.8
Expense reimbursement abuse                   8              4.8             2.4
Payroll: ghost or terminated staff            6              3.0             1.2

Total residual score: 50.5 before remediation, 19.3 after

Before remediation, fictitious vendor billing carries the highest residual score, followed by revenue cutoff and side agreements and by payment redirection, which is included even though Saltmarsh Industrial Supply Ltd. has had no such loss, because the risk is high for any company with electronic payments. The planned controls cut the total residual score from 50.5 to 19.3. The numbers are judgments, and their value lies less in the precise scores than in the discussion they force about which schemes matter most and which controls are worth funding.

Saltmarsh Industrial Supply Ltd.'s remediation plan includes segregating vendor master maintenance from payables and approval; requiring independent verification of new vendors, including registry and bank account checks and a match against employee data; requiring receiving evidence or a business-unit confirmation for service invoices; monthly analytics on payments, duplicates, thresholds and vendor-employee matches, reviewed by the controller; a contracts process that prohibits side agreements and requires sales terms to be approved by finance; a revenue cutoff review by finance for the last month of each quarter; annual conflict declarations; call-back verification of all bank detail changes; a revised bonus plan that rewards collected revenue and profitability rather than shipments alone; and an outsourced internal audit function reporting to the audit committee.

Whistleblowing programs and protections

Tips detect more fraud than any other method, so the design of the channels through which people report concerns matters greatly. Effective programs offer several channels (telephone, web, email, in person), allow anonymous reporting with a way to communicate with anonymous reporters, are available to employees, contractors, suppliers and customers, route reports independently of the people who may be implicated, protect reporters from retaliation, and report statistics to the audit committee. Summaries of the ACFE's 2026 data indicate that organizations with formal reporting mechanisms detect frauds faster and suffer lower losses than those without them, and that many small organizations still lack such channels. Saltmarsh Industrial Supply Ltd. had a hotline, which worked as designed in this case; both reports reached the audit committee chair directly.

In Canada, whistleblower protection is a patchwork. The Criminal Code makes it an offence for an employer to retaliate against an employee who provides information about an offence to law enforcement. Securities regulators protect whistleblowers who report securities law violations, and the Ontario Securities Commission's whistleblower program, launched in 2016, can pay awards of up to 5 million dollars for tips that lead to sanctions. Federal public servants are protected under the Public Servants Disclosure Protection Act, and some provinces have similar laws for their public sectors, but private-sector protection depends largely on employment law and on the organization's own policies.

Award programs create an incentive to report externally rather than internally, which some companies resist. The better response is an internal program that people trust: one that acknowledges reports, investigates them properly, protects reporters and tells them, in general terms, what happened. Organizations should never attempt to identify anonymous reporters or discourage reports to regulators; doing so may be unlawful and destroys trust.

Looking back on the course

The Saltmarsh Industrial Supply Ltd. case touched most of the topics in this course: fraud theory to understand motive and opportunity, scheme knowledge to recognize what the hotline reports described, analytics to measure the scheme and find related matters, evidence and interviewing to establish facts, tracing to follow the money, legal knowledge to work within the rules, damages and recovery to turn findings into results, and fraud risk management to prevent recurrence. Across all of them, the forensic accountant's value lies in independence, rigour and clarity: answering the questions asked, with evidence that others can verify, in language that decision makers can understand.