Planning and conducting an investigation

The first seven lessons described what frauds look like. The next three describe how forensic accountants investigate them. An investigation is a structured search for facts, carried out under legal, ethical and practical constraints, that must produce findings able to withstand challenge. Poorly planned investigations fail in predictable ways: evidence is lost or contaminated, the subject is alerted too early, the scope drifts, privacy or employment law is breached, privilege is waived, and the final report rests on assumptions rather than proof. This lesson follows the planning and early conduct of the Saltmarsh Industrial Supply Ltd. investigation from the hotline reports to the first interviews.

Predication: why investigate at all?

Investigations should begin only when there is predication: the totality of circumstances that would lead a reasonable, professionally trained and prudent person to believe that a fraud has occurred, is occurring or will occur. Predication protects employees from fishing expeditions and protects the organization from claims of unfair treatment, and it defines the starting scope. It does not require proof; a credible tip, an anomaly found by analytics, an audit finding or a complaint from a customer can each supply it. In the Saltmarsh Industrial Supply Ltd. matter, the two hotline reports, one specific and from an identified employee, the other anonymous but consistent with data the company held, gave predication for two lines of inquiry.

Triage of reports

Organizations with hotlines receive many reports, and most are not about fraud: workplace disputes, policy questions and grievances are common, and some fraud reports are vague or malicious. A triage process decides who looks at each report first, how quickly and with what independence. Reports implicating senior management or the finance function, or alleging financial statement fraud, should go to the audit committee rather than to management. Reports should be acknowledged, logged and tracked to resolution, and reporters, including anonymous reporters who can be contacted through the hotline system, should be told the outcome in general terms. The program below shows a simple triage of five reports received by Saltmarsh Industrial Supply Ltd.'s audit committee chair in February 2026.

# Triage of hotline reports received by Saltmarsh's audit committee chair (invented data).
# Scores reflect specificity, potential size, who is implicated and whether evidence is offered;
# the triage decides who looks at a report first, not whether it is true.
reports = [
    {"id": "H-26-004", "summary": "Q4 shipments to two distributors were sent with side letters allowing returns",
     "specific": 3, "amount": 3, "senior": 3, "evidence": 2, "anonymous": False},
    {"id": "H-26-005", "summary": "Supervisor takes long lunches",
     "specific": 1, "amount": 0, "senior": 0, "evidence": 0, "anonymous": True},
    {"id": "H-26-006", "summary": "New logistics vendor invoices never match a delivery I can find",
     "specific": 2, "amount": 2, "senior": 1, "evidence": 1, "anonymous": True},
    {"id": "H-26-007", "summary": "Coworker expensed the same client dinner twice",
     "specific": 3, "amount": 1, "senior": 0, "evidence": 2, "anonymous": False},
    {"id": "H-26-008", "summary": "Talk that purchasing accepts gifts from a supplier",
     "specific": 1, "amount": 1, "senior": 1, "evidence": 0, "anonymous": True},
]
W = {"specific": 2, "amount": 3, "senior": 3, "evidence": 2}
def route(score, r):
    if r["senior"] >= 3 or score >= 20: return "audit committee with outside counsel"
    if score >= 10: return "internal audit investigation"
    if score >= 5: return "management review"
    return "log, acknowledge and monitor"
for r in sorted(reports, key=lambda r: -sum(W[k] * r[k] for k in W)):
    s = sum(W[k] * r[k] for k in W)
    print(f"{r['id']}  score {s:>2}  {route(s, r):<38} {'(anonymous)' if r['anonymous'] else ''}")
    print(f"           {r['summary']}")

H-26-004  score 28  audit committee with outside counsel   
           Q4 shipments to two distributors were sent with side letters allowing returns
H-26-006  score 15  internal audit investigation           (anonymous)
           New logistics vendor invoices never match a delivery I can find
H-26-007  score 13  internal audit investigation           
           Coworker expensed the same client dinner twice
H-26-008  score  8  management review                      (anonymous)
           Talk that purchasing accepts gifts from a supplier
H-26-005  score  2  log, acknowledge and monitor           (anonymous)
           Supervisor takes long lunches

The revenue report, H-26-004, implicates a senior executive and scores highest, so it goes to the audit committee with outside counsel. The logistics invoice report, H-26-006, scores 15 and would normally go to internal audit, but Saltmarsh Industrial Supply Ltd. has only a small internal audit function that reports to the chief financial officer, and the subject is in finance; the audit committee therefore adds it to the scope of the external investigation. This override shows why triage rules guide judgment but do not replace it. The duplicate dinner claim goes to internal audit and turns out to involve C. Varga, as lesson 4 described. The gift allegation is reviewed by management with a request for specifics, and the complaint about long lunches is logged and referred to human resources.

The investigation cycle and the fraud theory approach

Investigators commonly work through a cycle: understand the allegation and the environment, form hypotheses, plan how to test them, gather evidence, analyse it, refine or reject the hypotheses, and repeat until the questions are answered or the evidence runs out. The ACFE calls this the fraud theory approach. Investigators assume, for planning purposes, the worst-case version of what might have happened, design tests that would prove or disprove it, and revise the theory as evidence arrives. A theory that the evidence contradicts is abandoned, not defended.

For the vendor allegation, the initial theory is that an employee with access to the vendor master and to invoice approval created a shell vendor and caused it to be paid for services never provided. Tests that would support it include evidence of who created the vendor, whether services were received, links between the vendor and an employee, and the flow of funds. Tests that would refute it include evidence of real logistics services, such as delivery records, carrier documents and the business units' confirmation that they used the vendor. For the revenue allegation, the theory is that year-end shipments were made on terms that made them reversible, that those terms were concealed, and that someone benefited. The team plans tests for each element.

Scope, team and budget

The engagement letter from lesson 1 sets the initial scope: the two allegations and related matters found in the course of the work. Defining scope precisely matters, because investigations naturally expand as new leads appear, and each expansion costs time, money and disruption. The team agrees with counsel a process for deciding whether new matters are added. At Saltmarsh Industrial Supply Ltd., the vendor review led to the scoring of all vendors (lesson 5) and the card and expense tests (lesson 4), which counsel approved as related matters; a separate concern about a former employee's non-competition agreement was referred back to the company.

The team is chosen for the matter. For Saltmarsh Industrial Supply Ltd., Corbett Lane Forensic LLP assigns a partner, a senior forensic accountant for each workstream, a data analyst, and a digital forensics specialist, with an employment lawyer on counsel's side. Budgets for investigations are estimates, because the work depends on what is found; the firm gives counsel a phased budget, with decision points after the data analysis and after the first interviews.

Legal and practical constraints

Investigations must respect the law, the organization's policies and the rights of the people involved. Employment law governs what an employer may require of employees, such as cooperation with an investigation, and how it may discipline them; unionized workplaces have collective agreements that may give employees the right to representation in interviews. Privacy law governs what personal information may be collected, used and disclosed, discussed further in lesson 9. Policies on the use of company devices and email determine whether the organization may search them; investigators should confirm that the organization's policy permits the search and that it is proportionate. Privilege, discussed in lesson 1, must be protected by routing communications through counsel and labelling documents appropriately.

In Canada, employers' rights to search employees' devices and email depend on provincial privacy law (where it applies to the private sector), PIPEDA for federally regulated and many commercial organizations, workplace policies and, in unionized settings, arbitral case law that weighs the employer's interest against employees' reasonable expectation of privacy.

Insurance matters too. A commercial crime or fidelity policy usually requires the insured to give notice soon after discovering a loss and to file a proof of loss within a set period, and it may require cooperation with the insurer's investigation. Missing these deadlines can void coverage. Saltmarsh Industrial Supply Ltd.'s counsel notifies Harrow Mutual Insurance on March 2, 2026, within days of the preliminary findings on Northfield.

Preserving evidence

As soon as an investigation is likely, the organization must preserve relevant evidence. Counsel issues a legal hold instructing custodians not to delete documents and suspending automatic deletion of email and other records. Electronic evidence is collected in a forensically sound way, creating verified copies (images) of hard drives, phones and mailboxes with documented chain of custody, so that its integrity can be proved later; CISSP-116 discusses digital evidence handling. Paper records are secured, copied and logged. Accounting system data are extracted with control totals that reconcile to the ledger, as ACCT-341 described.

Preservation often has to happen quietly. At Saltmarsh Industrial Supply Ltd., the digital forensics specialist images R. Calloway's laptop and mailbox on March 10, 2026 under the company's device policy, at a time arranged with IT so that no one is alerted. The vendor master change log, invoice images and payment records are extracted the same day. The revenue workstream preserves the email accounts and phones of the sales team before anyone is interviewed.

Sequencing the work

Investigators usually work from the outside in. They examine documents and data first, then interview neutral witnesses who can explain processes, then corroborating witnesses, then possible co-conspirators, and finally the subject. This order lets each interview build on what is already known, lets the investigator test the subject's explanations against evidence, and reduces the chance that the subject learns of the investigation early and destroys evidence or coordinates stories. The subject is usually interviewed last, but before the organization takes disciplinary action, so that the subject has a fair opportunity to explain.

The Saltmarsh Industrial Supply Ltd. plan follows this sequence. The data analysis in lessons 3 to 5 runs in late February. Interviews of payables clerks about how vendors are added and invoices approved, of warehouse staff about Northfield deliveries, and of the controller about approval limits take place in early March. R. Calloway is interviewed on March 12, 2026; immediately afterwards, the company places him on paid leave and suspends his system access, a decision taken by the company on employment counsel's advice, not by the investigators. G. Pellerin, the director of Northfield, agrees to be interviewed on March 19. The revenue workstream follows a similar path, interviewing the warehouse staff and the controller before the distributors and finally C. Varga.

Documenting and reporting progress

Every step of the investigation is documented in working papers that record what was done, by whom, when, on what evidence and with what result. Documentation should be factual and neutral, because it may be produced in litigation. Interim reporting to counsel is usually oral or in brief memoranda, to limit the number of documents that could be disclosed and to allow the scope to be adjusted. The final report, discussed in lesson 12, comes only when the work is complete.