Hypothetical Incident and Response
Investigating Fraud and Embezzlement in White Collar Crime

Incident

It is believed by the CEO of a medium-sized tech company that the CFO is engaged in the white collar crime of embezzlement. He is not sure why this is, but he has a gut feeling that the CFO—although well-liked by everyone—is doing something illegal. What has set him on edge about the CFO is that the company’s bank called while the CFO was on holiday and inquired about a check written to the CFO. The CEO could not say why such a check would be written to the CFO and all of a sudden it seemed that numerous red flags were visible: unexplained expenses charged to other units, for instance. Various units have made comments over the years that unexplained large expenses seemed to be charged to their units. Nothing was ever done because it seemed like a typical mistake of poor accounting. However, now the CEO is suspicious. The CEO wants the private investigator to look into this. If the CFO is embezzling, there should be some signs of this that an investigator could identify.

How It Occurred

It turns out the CEO is right to be concerned. The CFO is embezzling. His method is this: the company has a two-factor authentication process in place for authorizing all funds released by check—each check needs two signatures. The CFO would stop busy executives on their way out the door for holidays and get their signatures on several checks, saying that this would be just in case funds were needed while the executive was on holiday. The CFO would then use the signed blank checks to move money from the company’s accounts to his own. Then he would cancel the check, remove it from the bank’s reconciliation and destroy it. To reconcile the company’s accounting books, the CFO would charge the stolen amount to another’s unit as an expense.

What the Investigator Will Do

According to Nemeth (2019) and Sennewald (2004), white collar crime involving accounting means there should be an independent audit to see whether red flags can be identified and whether a paper trail can be discerned. The investigator should order an audit of the company’s accounts. If there are extraneous expenses to units, these should be flagged to see if there is a pattern. If units are unable to explain the expenses, a record should be made. Red flags do not prove fraud—but they may indicate that there is smoke, and where there is smoke it is very likely that there is fire.

What the investigator should do next is look at the people involved. The CFO is going to need to be investigated. For instance, what kind of home does he live in? Where is it? How luxurious is his lifestyle? What is his salary? Is the life he is living supportable on the salary he is receiving? Where did he come from? Fraudsters typically have a past history of fraud, so it would be worth looking into his background and what his history is with his other employers. They might be able to testify as to his character. Their stories will help further give information about who this CFO is.

Bank records also need to be consulted. If there is a series of canceled checks coming from the company to the CFO, this is going to be another pattern, and if the canceled checks align with the amounts expensed to the various units, it is going to be evidence of fraud. This information can all be gathered and used to confront the CFO. It may well be that it is enough to convince him to come clean.

Interview Plans for the Witnesses

The plan for interviewing witnesses is first to understand how the fraud might have been perpetrated at the company. Since a two-signature method is needed, it is necessary to understand how this would have happened. Only executives can sign checks so what is wanted is any information on the matter they can give. The plan here is to ask them if they have any memory of being asked to sign blank checks for the CFO.

The next step is to interview the CFO’s previous employers. What is wanted here is information that will help the investigator to...…attentive to what is going on around them, but they should also be unassuming for presumptions can lead them into dead ends.

What to Include in the Report

What should be included in the report is the nature of the crime, the evidence accumulated, how the crime was conducted if it is found that a crime was conducted, who were the persons involved in conducting the crime, and the time periods in which the crime was conducted, if the evidence shows this happened. The report should describe where information came from and how the investigation proceeded.

The report should be detailed and should begin with a statement of what the investigator set out to find. The findings should be clearly stated and it should be shown how those findings were arrived at, and what conclusions are drawn from the investigation.

The report should consist of facts only—no opinions or speculation. It should begin with an introduction that describes the nature and scope of the investigation. This should be followed by a summary of the investigation, including what the investigation was able to substantiate.

Next, the subject of the investigation should be identified and described. The individual at the heart of this report would be the CFO, and he should be described in full, including past employment history, present employment history, where he lives, what he does, and so on.

The investigative methods used should be described in a step by step manner. It should include everything the investigator did—where he went, when, to whom he talked, what times everything took place, how the investigation was conducted, and when the investigation ended.

It should close with a conclusion that describes the results of the investigation and what has been learned. It should end with closing remarks that show one is a professional, i.e., an expression of professional courtesy and thanks towards the client and to anyone else who contributed to or aided the investigation in any way. Exhibits and attachments may also be included, such as photographs, records legally obtained, video still frames, or anything else referenced in the report that could help to make it fuller.