acfe fraud prevention check-up - BKD

Factors to consider in developing the investigation plan include:• Time-sensitivity — Investigations may need to be conducted timely due to legal requirements, to mitigatelosses or potential harm, or to institute an insurance claim.• Notification — Certain allegations may require notification to regulators, law enforcement, insurers, orexternal auditors.• Confidentiality — Information gathered needs to be kept confidential and distribution limited to those withan established need.• Legal privileges — Involving legal counsel early in the process or, in some cases, in leading theinvestigation, will help safeguard work product and attorney-client communications.• Compliance — Investigations should comply with applicable laws and rules regarding gatheringinformation and interviewing witnesses.• Securing evidence — Evidence should be protected so that it is not destroyed and so that it is admissible inlegal proceedings.• Objectivity — The investigation team should be removed sufficiently from the issues and individuals underinvestigation to conduct an objective assessment.• Goals — Specific issues or concerns should appropriately influence the focus, scope, and timing of theinvestigation.Responsibility for overseeing an investigation should be given to an individual with a level of authority at leastone level higher than anyone potentially involved in the matter. Investigations of allegations involving seniormanagement should be overseen by the board or a committee of the board designated for that purpose. Legalcounsel may be appointed to supervise the investigation.Depending on the specifics of the allegation, the investigation team may need to include members of differentdepartments or disciplines to provide the knowledge and skill sets required. The following resources should beconsidered to determine whether their participation or assistance is necessary:• Legal counsel.• Fraud investigators.• Internal auditors.• External auditors.• Accountants or forensic accountants.• HR personnel.• Security or loss prevention personnel.• IT personnel.• Computer forensics specialists.• Management representative.The investigation team leader should coordinate the investigation and interface with management as necessary. Theroles and responsibilities of each team member should be communicated clearly. All team members should considerwhether there is an actual or potential conflict of interest with any of the issues or parties that could be involved.Should the organization not have adequate internal resources and/or if it is determined that internal resources arenot sufficiently objective, consideration should be given to retaining outside expertise.41