Internal Investigations Case Study
Following up on an external tip off, it was confirmed that a staff member, recruited on a temporary contract, had managed to obtain funds by fabricating insurance claims. The modus operandi of the case centred around the fact that the staff member had used the IT log on details and password of a former staff member and had then raised claims and cheques, which they subsequently collected from the finance department. The initial issue for the investigation team was that the staff member was unavailable for an interview and had appeared to have left the country. Whilst the initial the overall financial impact and number of fraudulent claims were yet to be realised, it was believed to be in excess of one million (£/€). On the basis of the amount of the potential reputational and financial losses, a decision was undertaken that the case should be dealt with as high priority and all resources, both internal and external would be applied to the case.
What we did
- Putting together a specialised team of internal and external investigators.
- Drawing up terms of reference and investigation plan.
- Ensuring that the investigation teams both internal and external were delegated with specific priority tasks.
- Setting expectations around the delivery of communications to stakeholders (legal, communications, business etc.) regarding the progress of the priority tasks.
- Immediate interaction with police networks, in order to assist in the apprehension of the individual.
- Understanding what and where evidence could be in this matter. Secure and centralise this evidence.
- Undertaking immediate interviews with internal witnesses.
- Restricting the number of parties aware of this matter.
- Closing down IT system access for all former and relevant staff members.
- Preserving IT equipment used by the staff member.
- Stopping cheques that had not been presented for payment.
- Considering if collusion was a factor and something that needed addressing in this case.
- Obtaining data downloads relating to claims that had been raised during a specified period in order to consider overall losses.
- Notifying insurers of the potential losses.
- Instructing internal stakeholders to manage customers who had been presented with cheques by the staff member, in order to protect the reputation and transparency of the investigation.
The actions of the investigation in the first 24 hours, managed to recover a substantial amount of the funds, the remainder were discovered to have been transferred abroad where there was no recourse. Through the immediate interviews performed it was identified that a number of individuals had been placed on the business to try and defraud the institution. These individuals were reported to the Police and relieved of their duties. The primary subject, in this case, was never apprehended it was believed they absconded abroad. This investigation highlighted weaknesses around the recruitment of staff and the overall claims processes which allowed this fraud to occur. Rectifying control measures were put in place within days of the investigation commencing.