Once we have identified grounds to investigate the information about alleged fraud or misconduct we enter a new phase of the process, that follows the initial triage. The level of confidence expected for triggering the full scale forensic investigation depends on the risk appetite at the organisation and the regulatory environment where it operates. For instance, criminal investigation standard introduced by the code on criminal procedure in Poland requires justified suspicion, e.g. we have received information about deviation from a sales procedure and information about circumstances that indicate intentional non-compliance, such as bid rigging in public procurement. On the other hand, we may also decide that full scale investigation starts when we did not manage to discount the allegation at the initial triage. In practice, we usually expect allegation that has not been dismissed at initial triage and additional “hint”, being a disturbing circumstance.
As soon as we have grounds to trigger the investigation we may start on planning of our follow up actions, developing forensic hypotheses and deciding on investigation team composition. The purpose of forensic investigations is to identify facts that support or deny the alleged wrongdoing. In order to identify the facts required to establish the truth about alleged misconduct we need to understand the alleged action(s) – i.e. the content of allegation(s), comprehend the alleged wrongdoing, either of criminal nature or other non-compliance or both – i.e. what forbidden act took place, and finally verify whether the actual facts support the allegation or not and if so, whether the actions establish constitute criminal act or other act of non-compliance. For the latter we may require to consult a legal counsel, following the Latin rule of “da mihi factum, dabo tibi ius“.
When we know the substance of allegation(s), based on the information triggering the investigation – where necessary updated / expanded in the initial triage phase – we need to formulate forensic hypotheses that will describe key evidence needed to confirm or deny the alleged wrongdoing. It is recommended to formulate at least two of them, the basic hypothesis would be the one that reflects the alleged wrongdoing, e.g. definition of bid rigging as as stipulated in article 305 ยง 1 of the Polish criminal code, the alternative hypothesis would be the conditions under which the procurement process was not illegally interfered. Having the hypotheses formulated we need to plan how are we going to confirm or deny them. These actions usually happen by inspecting documents, data or inquiring people who may know about the investigated case. Occasionally we may need to to engage an expert witness. More about evidence collection process in the next chapter. Development of a sequence of actions to be taken during the investigation process is the planning process. There are multiple IT platforms supporting the process of planning, but basic Excel or Numbers would suffice.
While planning we need also take decisions about the people whom we are going to engage with the task of fact finding. For this purpose me may require expertise in big data analysis, OSINT (open source intelligence), computer forensics, cognitive interviewing techniques, or knowledge about accounting, law, or analysed business processes. For this purpose we may need to understand whether we have the skills and knowledge in place, then we may entrust the investigation to our own people and assign the relevant team members to tasks in our planning schedule. It might happen, that some of the skills are missing, when co-sourcing may be a solution for us, where we borrow the required skills or knowledge from the market. Finally, we may not have the required skills or knowledge on board, or we may decide that the investigation should be handled by the external and independent party or we may require client-attorney privilege granted due to the gravity of the allegations. Then outsourcing would be an option.
This text does not constitute an exhaustive introduction into the planning, hypothesis building and resourcing the forensic investigation, but provides sufficient basics for self learning, experimenting and enhancing competence in this field. More on evidence collection in the next chapter.
