Investigating Allegations of Corporate Fraud: From Initial Assessment to Defensible Findings

Why evidence, professional judgment, and investigative independence determine the credibility of fraud investigations

Ray Romero, CPA, CIA, CFE, MBA
Founder & Managing Director
INTELL RISK & ADVISORY GROUP

An Allegation Is Not a Finding

Corporate fraud investigations often begin with incomplete information. An employee reports suspicious vendor payments, an accounting professional identifies unexplained journal entries, or an anonymous hotline complaint alleges that a manager has circumvented established approval procedures. These circumstances may warrant further examination, but they do not, by themselves, establish that fraud has occurred.

The investigator's responsibility is to determine what the evidence supports, not to substantiate an allegation simply because it appears credible. That distinction is fundamental to conducting an objective investigation. Allegations must be evaluated against transaction records, supporting documentation, relevant policies, witness accounts, and the circumstances surrounding the reported activity. Investigative conclusions should distinguish intentional misconduct from processing errors, control deficiencies, misunderstandings, and matters for which the available evidence remains inconclusive.

In my experience, the effectiveness of an investigation depends not only on the procedures performed, but also on the investigator's willingness to challenge initial assumptions, consider alternative explanations, and communicate findings accurately, particularly when those findings involve senior management or raise sensitive governance concerns.

Initial Assessment: Establishing the Scope and Investigative Objectives

A disciplined investigation begins by defining the allegation, identifying the transactions and individuals potentially involved, and determining the nature and significance of the organization's exposure. The initial assessment should establish whether sufficient information exists to warrant a formal investigation, identify records requiring immediate preservation, and determine whether the alleged activity may be continuing.

The assessment should also consider financial reporting implications, potential regulatory violations, employee misconduct, and whether the circumstances warrant involvement by legal counsel, executive management, or the Audit Committee. Where allegations involve senior management, the reporting structure becomes particularly important because the individuals ordinarily responsible for oversight may themselves have a conflict of interest.

An investigation plan should document the principal questions to be answered, anticipated sources of evidence, procedures to be performed, and responsibilities of the investigative team. Although the plan provides structure and accountability, it must remain sufficiently flexible to accommodate information that emerges during the examination. Investigations frequently develop beyond the original allegation, particularly when transaction testing identifies related control weaknesses, additional participants, or previously undisclosed activity.

Evidence Preservation and the Integrity of the Investigation

The preservation of evidence is among the most important early responsibilities of an investigator. Relevant information may reside in general ledger systems, accounts payable applications, electronic approval workflows, email accounts, banking records, purchasing systems, and employee communications. If these records are not preserved promptly, routine system processes, employee departures, or intentional alteration may compromise the investigation.

Preservation procedures should be coordinated with legal counsel, information technology personnel, and appropriate management representatives. Depending on the circumstances, these procedures may include securing electronic records, retaining system access logs, preserving original documents, and establishing documented custody and handling procedures for material evidence. Where forensic collection is necessary, the process should preserve the integrity of the source information and maintain sufficient documentation to establish how the evidence was obtained.

Equally important is the distinction between preserving evidence and interpreting it. A questionable invoice, altered vendor record, or unusual payment authorization may be relevant to an investigation, but its significance must be established through additional examination. Investigators should avoid drawing conclusions from isolated documents without evaluating the surrounding transactions, business circumstances, and available corroborating information.

Reconstructing Transactions and Following the Financial Evidence

Financial records often provide the most reliable starting point for establishing how suspected misconduct occurred. Investigators may examine vendor master files, purchase orders, invoices, payment authorizations, general ledger entries, bank records, and related correspondence to reconstruct the underlying transactions. The objective is to determine whether payments were legitimate, properly authorized, accurately recorded, and consistent with established business practices.

Analytical procedures can identify relationships and patterns that may not be apparent through conventional document review. These may include duplicate invoice characteristics, vendors sharing banking information, unusual payment sequences, unauthorized vendor master-data changes, or disbursements occurring outside established operating patterns. However, an analytical exception is not proof of fraud. The investigator must determine whether the underlying records substantiate an irregularity and whether additional procedures are necessary to establish its nature and significance.

A chronological reconstruction of events can be especially valuable. By connecting the creation of vendor records, changes in payment instructions, approval activity, communications, and subsequent disbursements, investigators can identify relationships that might otherwise remain concealed. This approach also helps distinguish isolated processing errors from recurring or coordinated activity involving the circumvention of established controls.

Conducting Interviews and Corroborating Explanations

Interviews are an essential component of many corporate fraud investigations because financial records do not always explain why a transaction occurred or who exercised responsibility for a particular decision. A properly structured interview can clarify business processes, establish individual responsibilities, identify additional evidence, and evaluate explanations for unusual activity.

Interview planning should be informed by the documentary evidence already obtained. Investigators generally benefit from first speaking with individuals who understand the relevant processes and controls before interviewing those more directly associated with the questioned transactions. Questions should be designed to obtain factual information, explore inconsistencies, and test competing explanations rather than confirm assumptions about wrongdoing.

My experience conducting investigative interviews in multiple countries has reinforced the importance of preparation, professional judgment, and cultural awareness. Business practices, organizational hierarchies, and communication styles may differ across jurisdictions, but the underlying investigative objective remains the same: obtain reliable information, evaluate it objectively, and corroborate material statements through independent evidence whenever practicable.

An interviewee's explanation should not be accepted or rejected solely on the basis of demeanor or perceived credibility. Significant statements should be compared with contemporaneous records, financial transactions, system activity, and other witness accounts. The strength of the investigative conclusion should rest on the totality of the evidence rather than any single statement.

Distinguishing Control Deficiencies From Intentional Misconduct

One of the more challenging aspects of a fraud investigation is determining whether an irregularity reflects an operational error, an inadequately designed control, management override, or deliberate misconduct. Although these circumstances may produce similar transaction patterns, their implications for management accountability, financial reporting, and corrective action can differ substantially.

For example, payments repeatedly processed just below an established authorization threshold may indicate deliberate efforts to circumvent approval requirements. However, the same pattern may result from legitimate invoicing arrangements or established operational practices. Investigators must examine the supporting contracts, transaction chronology, applicable policies, communications, and evidence bearing on the individuals' knowledge and intent before reaching a conclusion.

Where the evidence establishes a control deficiency but does not substantiate intentional misconduct, the investigation should report that distinction clearly. Conversely, where documentary evidence and corroborated information establish deliberate circumvention or falsification, the findings should accurately describe the conduct and its significance. Professional judgment requires investigators to follow the evidence wherever it leads, including when the results challenge management's initial explanation.

A Real-World Investigation: Fraud, Management Pressure, and Audit Independence

During an internal audit of the South African subsidiary of a large U.S. technology corporation, I identified significant irregularities involving accounts payable transactions and cash disbursements. Examination of the underlying records revealed fictitious vendors, unauthorized payments, and falsified approval documentation, including forged signatures and approval stamps. The irregularities extended over approximately three years and exposed fundamental weaknesses in vendor verification, payment authorization, and disbursement controls.

As the examination progressed, the significance of the findings extended beyond the transactions themselves. When I communicated the results to the organization's CFO, I was asked to characterize the irregularities as clerical errors rather than report their actual significance. Based on the evidence developed during the investigation, I could not support that characterization. I maintained the integrity of the findings and escalated the matter to the Audit Committee Chair, ensuring that the appropriate governance authority received an accurate account of the circumstances and associated risks.

The matter was followed by significant organizational changes, including the CFO's resignation, replacement of the South African management team, and implementation of stronger disbursement controls. While those outcomes were management and governance decisions, the investigation provided important evidence concerning the underlying transactions and control weaknesses.

This experience reinforced a principle that has guided my professional approach to auditing and investigations: the investigator's responsibility is not to deliver the conclusion management prefers, but to determine what the evidence supports and communicate those findings objectively. The ability to reconstruct transactions and identify control failures is essential, but so is the willingness to preserve professional independence when the findings are challenged.

The case also illustrates the importance of effective governance. Even a technically sound investigation can lose its value if significant findings are minimized, suppressed, or communicated through individuals with conflicting interests. Direct access to the appropriate oversight authority, supported by documented evidence and clear reporting, is essential to maintaining the credibility of the investigative process.

Evaluating Evidence and Developing Defensible Findings

A reliable investigative conclusion requires more than accumulating documents or identifying suspicious patterns. Investigators must evaluate whether the evidence is relevant, reliable, sufficiently corroborated, and consistent with the conclusions being considered. This includes examining original records where available, reconciling financial information to independent sources, evaluating conflicting explanations, and documenting the reasoning supporting each significant finding.

The following framework illustrates how common investigative questions can be addressed through complementary procedures.

These procedures should be tailored to the circumstances of the investigation rather than applied as a mechanical checklist. In some cases, the most consequential evidence may be a sequence of system changes or payment approvals; in others, it may involve contradictory explanations, concealed relationships, or documentation demonstrating that established procedures were intentionally bypassed.

Investigators must also recognize the limitations of the available evidence. Where records are incomplete or access to information is restricted, the report should explain how those limitations affect the conclusions. A finding that cannot be substantiated should not be presented as established fact, regardless of how suspicious the underlying circumstances may appear.

Reporting Findings to Management and the Audit Committee

An investigative report should communicate the matter examined, the scope of procedures, significant evidence, factual findings, limitations, and conclusions in a manner that allows the intended audience to understand how those conclusions were reached. The report should distinguish substantiated facts from allegations, analytical inferences, and unresolved questions, while providing sufficient detail to support management and governance decisions.

When findings involve potential misconduct by senior executives or individuals responsible for the organization's control environment, reporting protocols must preserve the independence of the investigation. Depending on the organization's governance structure and the nature of the matter, direct communication with the Audit Committee or another appropriate independent authority may be necessary. Legal counsel should also be involved where legal exposure, reporting obligations, or potential litigation require specialized consideration.

The value of an investigation extends beyond determining whether an allegation was substantiated. Management and the Audit Committee should understand how the activity occurred, whether similar vulnerabilities may exist elsewhere, and what corrective actions are necessary to address the underlying causes. Recommendations should be specific, proportionate to the risks identified, and directed toward strengthening the design and operating effectiveness of relevant controls.

Professional Judgment and the Responsibility to Remain Objective

Fraud investigations rarely proceed in a perfectly linear sequence. New records may contradict initial assumptions, witness accounts may conflict, and transaction analysis may identify additional issues requiring examination. Investigators must continually reassess the available evidence, determine which procedures are necessary, and remain willing to modify their conclusions when new information warrants doing so.

Professional skepticism does not mean assuming that misconduct has occurred. It means maintaining a questioning mind, critically evaluating the evidence, and resisting unsupported explanations regardless of their source. This obligation becomes particularly important when investigators face pressure to accelerate an inquiry, narrow its scope, or characterize significant irregularities in a manner inconsistent with the underlying facts.

In my view, the credibility of an investigation is ultimately determined by the integrity of its methodology and the objectivity of its conclusions. Investigators must be prepared to explain what procedures were performed, what evidence was obtained, how competing explanations were evaluated, and why the findings are supported. That discipline is what allows investigative conclusions to withstand scrutiny from management, Audit Committees, regulators, and, when necessary, legal proceedings.

Conclusion

Investigating allegations of corporate fraud requires a disciplined methodology that integrates financial analysis, documentary examination, interviews, evidence preservation, and professional judgment. Suspicious transactions may initiate an investigation, but only a thorough evaluation of the underlying facts can establish whether misconduct occurred, identify the associated control weaknesses, and support appropriate corrective action.

The South Africa investigation illustrates why investigative independence is as important as technical competence. Identifying irregularities and reconstructing transactions are essential responsibilities, but the findings must also be communicated accurately, particularly when management challenges their significance. The investigator's obligation is to the evidence and the integrity of the investigative process, not to a predetermined outcome.

For Boards, Audit Committees, and executive management, a well-conducted investigation provides more than a determination concerning an allegation. It establishes an evidence-based understanding of what occurred, why existing controls failed, and what actions are necessary to strengthen accountability and reduce future exposure.

The measure of a successful investigation is not whether it confirms the original allegation. It is whether the conclusions are objective, substantiated, and defensible.

Professional References

• Association of Certified Fraud Examiners, Fraud Examiners Manual, guidance on investigative methodology, evidence, and interviewing.
• The Institute of Internal Auditors, Global Internal Audit Standards, effective January 2025.
• Committee of Sponsoring Organizations of the Treadway Commission (COSO) and Association of Certified Fraud Examiners, Fraud Risk Management Guide, Second Edition, 2023.

INTELL RISK & ADVISORY GROUP
Complex Matters. Evidence-Based Answers.

Ray Romero, CPA, CIA, CFE, MBA
Founder & Managing Director

Fraud | Forensic Accounting | Investigations | Litigation Support | Expert Witness | Internal Audit | Complex Accounting | Due Diligence & M&A

Confidential inquiries: ✉ inquiries@intellriskadvisory.com
☎ (408) 782-4131