Planning and Conducting Your Internal Fraud Examination · Planning and Conducting Your Internal Fraud Examination James D. Ratley, CFE President and CEO Association of Certified

Planning and Conducting Your

Internal Fraud Examination

James D. Ratley, CFEPresident and CEO

Association of Certified Fraud Examiners

2 of 20

Steps in a Fraud Examination

Phase 1: Collecting Evidence

3 of 20

Phase 1: Collecting Evidence

4 of 20

5 of 20

Document and Record Examination

� Internal sources� Business records (e.g., Accounting, HR)

� Suspect’s office

� Emails and computer files

� External sources� Public records

� Databases

� Third-party records (e.g., vendors, creditors, banks)

� Social media sites

Document and Record Examination

� Identifying signs of

manipulation� Forensic document analysis

� Digital forensic analysis

� Data analysis

6 of 20

Collecting Evidence

7 of 20

8 of 20

Collecting and Maintaining Documents

� Chain of custody

� Preserving evidence

� Organizing evidence

9 of 20

Observation

� Physical inspections

� Surveillance� Covert vs. overt

� Undercover investigations

Interviewing Neutral Third Parties

� Who should be interviewed and in what order

� Information each witness should be able to

provide

� Appropriate questioning techniques

� Evidence that might help corroborate the

witnesses’ statements

10 of 20

Phase 2: Corroborating Evidence

11 of 20

Interviewing Corroborative Witnesses

� Facts the witness should be able to refute or

confirm

� Documents the witness might possess that

could confirm or refute the facts obtained

� New facts or information that might have

been missed

12 of 20

Interviewing Co-Conspirators

� Admission-seeking vs. informational

� Co-conspirator’s relationship with suspect

� Method used to approach co-conspirator

� New information the co-conspirator could

provide

13 of 20

Phase 3: Admission-Seeking Interview

14 of 20

15 of 20

Admission-Seeking Interview

16 of 20


� Evidence to be used during the interview

� Interview location and logistics

� Method used to approach suspect

� Legal considerations� Employee rights

� Miranda warnings

� Unions

17 of 20


� Obtain signed statement of confession

� Confirm or refute facts and information the

suspect provided during the interview

18 of 20

Concluding the Investigation

� Write investigation

report

� Present investigation

findings

Conclusion

19 of 20

James D. Ratley, CFEPresident and CEO

Association of Certified Fraud Examiners

Contact Information:

Telephone: (800) 245-3321

Email: [email protected]

LinkedIn: James Ratley

Twitter: @JimRatley