The cost of occupational fraud is on the rise, with recent reports pointing to heavy financial losses among organisations subject to employee wrongdoing.
Occupational Fraud 2026: A Report to the Nations, published in May by the Association of Certified Fraud Examiners (ACFE), put the median loss per instance of occupational fraud among 2,402 organisations worldwide at $104,000 (€130,000).
In Ireland, meanwhile, The Irish Times reported that the cost of employee fraud to Irish organisations in 2024 was close to €10 million, a fourfold increase on the year prior.
At the same time, there is a growing focus on fraud prevention and whistleblowing in the legal and regulatory environment.
The Protected Disclosures Act 2014 (as amended) requires organisations to have appropriate whistleblowing channels in place, while the Failure to Prevent Fraud offence, introduced under the UK’s Economic Crime and Corporate Transparency Act 2023, requires Irish organisations with a UK nexus to take steps to prevent fraud.
Fraud prevention
Given both the financial consequences of fraud and rising regulatory standards, it is unsurprising that fraud prevention has become an increasingly important item on the governance agenda.
The ACFE defines fraud as “the use of one’s occupation for personal enrichment through the deliberate misuse or misapplication of the employing organisation’s resources or assets”. It groups occupational fraud into three primary categories: asset misappropriation; corruption; and financial statement fraud.
Within organisations, fraud prevention is achieved through culture- and process-level controls. While weaknesses in these controls can be identified and addressed by means of ongoing review and fortification, even the most robust cannot entirely eliminate the risk.
When suspected fraud arises, organisations must shift from prevention to investigation. Unlike the control environment, investigations are one-off exercises undertaken in response to specific circumstances.
As a result, procedural weaknesses in a fraud investigation may only become apparent after conclusions have been reached and decisions made. The quality of an investigation is therefore measured not just by its conclusions, but also by the fairness and robustness of the process used to reach them.
This article explores the steps organisations should take before a fraud investigation begins to protect the integrity of the investigation’s outcomes.
Receipt of the fraud allegation
Picture the scene: you are a member of the board of a long established and reputable company. It is two weeks from the company’s financial statement filing deadline and the external audit is nearing completion.
A whistleblowing complaint is received, alleging that a major fraud has been perpetrated by a trusted employee.
Naturally, alarm bells are raised and a wave of anxieties come to the fore: How have our controls been circumvented? Can we still file our accounts on time? Should the employee be suspended? What if the public finds out?
While there is certainly an urgent need for resolution, some carefully considered decisions must be made in the moments following the receipt of such an allegation. An organisation’s legal advisers will help navigate these critical decisions and should be consulted immediately.
Determining the objective of the investigation
When commissioning an investigation, organisations must define the questions it is intended to answer. In doing so, they should consider the decisions they ultimately need to make, such as whether financial statements are misstated, disciplinary action is required or a regulator should be notified.
Failure to formulate clear questions can result in an investigation being pulled in multiple directions by competing stakeholder demands. This is not only inefficient but can also create uncertainty for employees involved in the process.
In cases of suspected fraud, organisations often seek answers to a range of questions including whether the suspected fraud has in fact occurred, the extent of any loss that may have resulted and the control failures that may have enabled it.
While there might be a temptation to address all questions simultaneously, each will require different evidence and investigative procedures.
Organisations should therefore consider whether a phased approach is appropriate, prioritising matters requiring immediate attention and establishing a logical sequence for subsequent enquiries.
Irrespective of their number, these questions should be clearly defined from the outset to avoid ambiguity and provide the investigation with a clear direction.
Appointing an investigator
Appointing an investigator is a crucial decision. Organisations will consider whether to use an internal or external investigator. Irrespective, they will need to ensure that the investigator:
• has relevant expertise to address the investigation’s question(s);
• is independent; and
• has experience conducting investigations.
Considering these factors will help reduce the risk of any challenges to the investigation’s integrity resulting from the choice of investigator.
In small- to medium-sized organisations, employees in certain functions, such as finance, may have the expertise needed to identify anomalies in financial records.
Identifying a suitable employee with the necessary expertise and independence to investigate a suspected fraud can be challenging, however.
Further, bringing employees into the investigation, even for preliminary views, can increase the risk of confidential information being disseminated outside the confines of the investigation.
While large organisations may possess subject matter and investigative expertise within independent functions, such as internal audit, the circumstances of the investigation may still call for an external party.
If the investigation relates to a senior employee, for example, or external stakeholders are concerned about the outcome of the investigation, the appointment of an external investigator can serve to reduce any perception of non-independence in the investigation.
The investigation’s terms of reference
The terms of reference (TOR) is one of the most important governance documents in any fraud investigation. Many procedural disputes arise not in response to the work of the investigator, but because key issues such as scope, interview procedures and reporting requirements were not clearly agreed at the outset.
A well-drafted TOR establishes a common understanding between the organisation and investigator, while also reducing ambiguity and helping to mitigate procedural challenges.
A cornerstone of the investigation will be compliance with fair procedures and natural justice. These constitutional principles entitle individuals to fair and unbiased treatment.
The TOR will clearly state the basis for conclusions. A fact-finding investigation will require conclusions to be limited to findings of fact assessed on the balance of probabilities, for example, while excluding findings of culpability.
Some other procedural matters relating to fair procedures and natural justice include reporting lines, interview procedures and reporting requirements.
Reporting lines
Unclear reporting lines lead to delays, inconsistent instructions and unnecessary disclosure of confidential information.
The TOR should identify who is responsible for receiving updates from the investigator and who has authority to approve additional investigative work. Limiting communication channels helps maintain confidentiality and reduces the risk of the investigation being diverted by competing stakeholder demands.
The TOR should also identify a primary point of contact with responsibility for providing information to the investigator and coordinating requests. This role is demanding and should be assigned to an individual with sufficient capacity and authority to support the investigation effectively.
Well-defined reporting lines help promote efficiency, consistency and confidentiality throughout the investigation process.
Interview procedures
Interview procedures are frequently scrutinised in challenges to the fairness of an investigation and therefore require careful consideration at the outset.
It is vitally important that an investigator provides individuals (both those accused of wrongdoing and witnesses) with an opportunity to be interviewed.
The manner in which interviews are conducted is fundamentally important to protecting the integrity of the evidence obtained during those interviews.
Some common procedural matters that arise in fraud investigations are as follows:
o Whether interviewees should be provided with questions and relevant documentation in advance of interview.
This is often a contentious issue. Advance disclosure will assist an interviewee in understanding the allegations and providing a considered response. On the other hand, organisations may have concerns that extensive disclosure could affect the quality of evidence obtained. The appropriate approach will depend on the circumstances of the investigation. The TOR should therefore establish expectations regarding the nature and extent of information that will be provided to interviewees in advance of interview.
o How to handle individuals who decline to participate in an interview, repeatedly postpone meetings or engage only partially with the interview process.
While investigators should afford individuals a reasonable opportunity to respond to allegations or evidence, investigations cannot be delayed indefinitely. The TOR should establish the procedures to be followed where an individual does not fully engage and clarify whether the investigator may proceed to conclusions based on the evidence available.
o Reliance on interview notes as critical evidence that may be required when assessing the accuracy of factual findings.
Difficulties can arise where an interviewee subsequently disputes the content of the notes or alleges that important context has been omitted. The TOR should therefore establish how interviews will be recorded and the procedures for agreeing interview notes.
Reporting requirements
Disputes regarding the purpose of an investigation often emerge when the final report is issued, making it essential that reporting requirements are clearly defined from the outset of the investigation.
The TOR will typically specify the content required in the report, including the methodology adopted, the information relied upon and the findings.
The report should identify any limitations encountered during the investigation and their potential impact.
The TOR should also establish procedures where proposed findings could adversely affect an individual, including providing that individual with an opportunity to respond before conclusions are finalised.
Clear purpose: defining objective, scope and governance
Whenever allegations of wrongdoing arise, alarm bells ring and there can be a natural tendency to commission a wide-ranging investigation to answer a myriad of complex questions.
While there is often a need to act urgently, the need for action should not come at the expense of making considered decisions about the objective, scope and governance of the investigation.
Unlike weaknesses in a control environment, procedural shortcomings in an investigation may only become apparent after conclusions have been reached and decisions have been made. By that stage, opportunities for remediation will be limited.
Those organisations that invest time at the outset in clearly defining the purpose of the investigation, appoint an appropriate investigator and establish robust procedures, are better positioned to reach outcomes that are both fair and defensible.
Failure to do so will result in governance and procedural shortcomings that risk exposing the organisation to reputational damage and undermining confidence in the investigation’s conclusions.
Michael McCann is Director, Forensics and Investigations, Transaction Advisory Services, Grant Thornton