Suspect a staff fraud? Preserve the records first
If a brokerage suspects an employee of fraud, how to keep its records, documents and journals intact before a forensic investigator is called in.
By Achekam · · 4 min read · For Insurance businesses in South Africa, Nigeria, Kenya
The bookkeeper notices that client refunds have been going to the same bank account for months. The account name is a family member of someone in the office. The principal's first instinct is to call that person in, demand an explanation, and go through their computer that afternoon. It is the most natural response in the world, and it is often the one that makes the fraud impossible to prove.
When a brokerage suspects one of its own people, the first job is not to find out everything. It is to keep everything exactly as it is, so that someone trained to investigate can find out properly. This piece explains why, and how to preserve the records a brokerage keeps in Achekam and elsewhere.
What an investigation is trying to establish
The ACFE defines occupational fraud as fraud committed by a person against the organisation for which they work. ACCA explains that the purpose of a forensic investigation into an alleged fraud is to discover whether a fraud actually took place, identify those involved, quantify the financial loss suffered by the client, and present findings to the client and potentially to court.
ACCA describes forensic accounting as the whole process of investigating a financial matter, including potentially acting as an expert witness if a fraud comes to trial. That last part is why preservation matters so much. The records you keep today may have to stand up at a disciplinary hearing or in court, examined by someone whose job is to find a gap.
Chain of custody: why gaps make evidence useless
ACCA explains that forensic investigators must keep a clear chain of custody over evidence, because inconclusive evidence or gaps in the chain of custody may lead to the evidence being challenged in court or becoming inadmissible.
Chain of custody simply means being able to show who had a document or a device, when, and that nobody changed it in between. Well-meaning managers break the chain all the time: printing e-mails and scribbling on them, forwarding files to a personal address, logging in to the suspect's computer to "have a look". Each one gives the other side a reason to say the evidence could have been altered. Where a laptop or phone may hold evidence, leave it in the state it is in, lock it away and let the investigator collect it.
Keep documents and their versions intact
Most of a brokerage's evidence is documents: proposal forms, policy schedules, refund instructions, supplier invoices, e-mails approving payments. In Achekam, documents live in Document Centre, a set of folders where files and whole folders are uploaded, previewed, downloaded, renamed, moved, tagged, archived and searched. Uploading a new version does not wipe the old one; the earlier versions are kept. If someone replaced a document with an altered copy, the earlier version is still there.
Every stored file also gets a SHA-256 fingerprint, a value calculated from the file's contents that changes if the file changes. Executable files are refused by default, and every upload passes a malware check. For an investigation, the fingerprint helps show that a file the investigator examines is the one that was stored, and that nobody has edited it since. Fingerprints of documents are explained further in document fingerprints and what they prove, and filing practice for matters in keeping matter files in Document Centre.
What to do now:
- do not rename, move or tidy the folders the suspect worked in;
- do not delete anything, even obvious duplicates;
- keep the people working in those folders to the few managing the matter;
- note the date and time you became aware, and who you told.
Why posted journals are reversed, never deleted
The ledger is the other half of the evidence. In Achekam the general ledger lists every posted line, and the trial balance shows each account for a period or at a date and whether debits equal credits. A business can post manual journals, but an unbalanced journal, or one dated in a closed month, is refused, and a posted journal is corrected only by a reversal.
That rule works in an investigation's favour. A fraudulent journal cannot quietly vanish: the original stays in the ledger, and any reversal sits beside it with its own date. Resist the urge to "clean up" entries you believe are fraudulent before the investigator has seen them. Even a correct reversal, posted too early, changes what the ledger looks like on the day the investigator starts. Correcting a posted journal explains the reversal process for when the time comes.
Export the general ledger and the trial balance for the period in question now, and keep those exports, dated and unaltered, alongside the live records.
Steps to avoid
- Confronting early. The person warned has time to delete e-mails, take documents home and agree a story with anyone else involved.
- Deleting. Not even the obviously personal or the plainly irrelevant.
- Tidying up. No reorganising folders, renaming files or correcting entries.
- Investigating yourself. Logging in as the suspect, searching their devices or questioning colleagues.
- Talking widely. Keep the circle to the people who must know.
Do take steps to stop further loss: suspend the person's authority to approve payments, change shared passwords and ask the bank to apply extra checks, without explaining why to the wider office.
ACCA's article on forensic accounting explains what a forensic investigation sets out to do and why the chain of custody matters.
Call a forensic investigator and your legal adviser before you call in the employee. Everything you preserve in the meantime is something they can use.
General guidance only, not advice on your own circumstances. Tax and payroll rules change: check the current position with the authority or your adviser.
