acfe fraud prevention check-up - BKD

The investigation team should document and track the steps of the investigation, including:• Items maintained as privileged or confidential.• Requests for documents, electronic data, and other information.• Memoranda of interviews conducted.• Analysis of documents, data, and interviews and conclusions drawn.Reporting the ResultsThe investigation team should report its findings to the party overseeing the investigation, such as seniormanagement, directors, or legal counsel. Where legal counsel is supervising the investigation, counsel willdetermine the appropriate form of the report. The nature and distribution of the report may be affected by thegoals of protecting legal privileges and avoiding defamatory statements. For similar reasons, advice of counselshould be sought before the party overseeing the investigation makes public statements or other communicationsregarding the investigation.Corrective ActionAfter the investigation has been completed, the organization will need to determine what action to take in responseto the findings. Any findings of actual or potential material impact may need to be reported to the board, the auditcommittee, and the external auditor if they are not receiving investigation reports directly. Notification may also berequired to legal and regulatory agencies and the organization’s insurers.In some cases it may be necessary to take certain actions before the investigation is complete (e.g., to preserveevidence, maintain confidence, or mitigate losses). This could require suspension or reassignment of individualsor legal actions to restrain assets. Those responsible for such decisions should ensure there is a sufficient basisfor those actions.Any action taken should be appropriate under the circumstances, applied consistently to all levels of employees,including senior management, and should be taken only after consultation with individuals responsible for suchdecisions. Management consultation with legal counsel is strongly recommended before taking disciplinary, civil,or criminal action.Possible actions include one or more of the following:• Criminal referral — The organization may refer the case to law enforcement voluntarily, and, in somecases, it may be required to do so. Law enforcement has access to additional information and resources thatmay aid the case. Additionally, referrals for criminal prosecution may increase the deterrent effect of theorganization’s fraud prevention policy. An appropriate member of senior management, such as thechief legal counsel, should be authorized to make the decision as to whether pursuing criminal prosecutionis appropriate.• Civil action — The organization may wish to pursue its own civil action against the perpetrators to recoverfunds.• Disciplinary action — Internal disciplinary action may include termination, suspension (with or withoutpay), demotion, or warnings.• Insurance claim — The organization may be able to pursue an insurance claim for some or all of its losses.43