Preserving accounting evidence after an embezzlement is crucial for pursuing the perpetrator of the fraud in civil and criminal courts. Forged checks, duplicate payments, fake expenses, hidden personal expenses, and inflated expenses are only a few of the countless ways an employee can embezzle from within an organization.
Immediate Action Steps
1. Secure Access and Lock Out the Suspect
The first step to preserving evidence is to ensure that the suspect has been completely locked out of the organization's physical and digital records. The suspect should immediately be removed of access from the organization's physical devices, all accounting records including accounting software, banking access and records, credit cards, invoices, payroll, and internal document systems.
2. Preserve Accounting Records
If the suspect of the fraud had access to the organization's bank accounts and the organization's accounting records, the trail of evidence leading to the fraud may have been left within the organization's accounting records. To preserve this key evidence, it's essential to immediately make a complete copy of the organization's accounting records including the accounting software and general ledger exactly as the suspect left it.
3. Maintain Audit Trails
By making a copy of the organization's accounting software, the organization can also preserve the audit log within the accounting software. The audit log is a feature of the accounting software that tracks the creation, modification, and deletion of transactions. This allows the forensic investigator to identify who recorded the fraudulent entries, when they were recorded, and what the entries were.
Working with Forensic Experts
During the course of the fraud investigation, the investigator may identify falsified accounting entries and fraudulent journal entries that need to be corrected. By making a copy of the accounting software and general ledger, the organization can begin to correct their books while still preserving the fraudulent entries. This also allows the forensic accounting investigator to present the falsified entries, as well as the corrected entries, in court.
It may also be necessary for the organization to retain the services of a digital forensics investigator to preserve the digital evidence associated with the embezzlement.
As Certified Fraud Examiners, Engel & Engel has conducted hundreds of fraud investigations and testified as expert witnesses in numerous cases that have led to substantial fraud judgements.
