A fraud examination is a structured investigation that begins with a specific suspicion of wrongdoing and works methodically to answer four questions: did fraud happen, who did it, how much was lost, and can the case be proven in court or an internal proceeding. That focus is what separates it from a financial audit, which asks the broader and more neutral question of whether financial statements are fairly presented. An examination starts with a reason to look and follows the evidence from there. According to the Association of Certified Fraud Examiners, 43 percent of occupational fraud cases surface through tips rather than audits or internal controls, so most examinations open not with a broken number but with a person who came forward.1Association of Certified Fraud Examiners. 2024 ACFE Report to the Nations
Predication: The Reason to Open a Case
Predication is the threshold requirement. It refers to the circumstances that would lead a reasonable, trained professional to believe that fraud has occurred, is occurring, or will occur. The ACFE Code of Professional Standards requires examiners to establish predication and define scope priorities before starting, and to reassess both as the case develops.2Association of Certified Fraud Examiners. CFE Code of Professional Standards Without predication, an examination should not begin. That rule is what keeps the process from turning into a fishing expedition or a pretextual review of an unpopular employee.
Predication can come from an anonymous hotline tip, an anomaly picked up during an internal audit, a pattern of suspicious transactions, or a complaint from a vendor who never received payment. The examiner’s first task is deciding whether the allegation is credible enough to justify a full investigation, weighing the reliability of the source, the specificity of the claim, and whether the described conduct would actually be fraud. Confidentiality matters at this stage. Premature disclosure can tip off the subject, invite evidence destruction, or expose the organization to a defamation claim if the allegation turns out to be wrong.
Planning the Work
With predication in hand, the examiner builds an investigative plan: what questions the examination must answer, which documents and data sources could answer them, and who needs to be interviewed and in what order. The plan also has to address who has authority to access which records, what legal constraints apply, and what a realistic timeline looks like. The ACFE standards require the work to be adequately planned and the scope to be agreed with the client or employer before substantive work begins.
Preserving Evidence with a Litigation Hold
One of the first practical steps after predication is preserving evidence. When fraud is suspected and litigation is reasonably anticipated, the organization has a duty to hold documents and electronic data that could be relevant. This is commonly called a litigation hold. Failing to preserve can trigger spoliation sanctions ranging from negative inferences at trial to outright exclusion of evidence. Under federal law, anyone who knowingly destroys or falsifies records to obstruct an investigation faces up to 20 years in prison.3Office of the Law Revision Counsel. 18 USC 1519 – Destruction, Alteration, or Falsification of Records in Federal Investigations Even outside the federal context, an organization that skips the hold and later ends up in court has a serious problem.
Gathering and Preserving Evidence
Evidence gathering is where most of the work happens. Examiners collect and analyze documentary evidence (financial records, contracts, internal memos), electronic evidence (emails, server logs, accounting system data), and, less often, physical evidence such as altered checks or forged signatures. Electronic data usually requires forensic techniques to extract and preserve without altering the original files.
Chain of custody has to be maintained for every item. The IRS Criminal Investigation division uses detailed protocols governing how evidence is seized, logged, transferred, and stored so it remains admissible.4Internal Revenue Service. Internal Revenue Manual 9.4.9 – Search Warrants, Evidence and Chain of Custody Private-sector examiners follow comparable procedures: documenting when each item was obtained, who handled it, and how it was stored. If you cannot show that a document was not tampered with between collection and trial, defense counsel will make sure the jury hears about it.
Financial analysis is often the most revealing part of this phase. Examiners use specialized software to trace transactions, spot patterns that do not match legitimate business activity, and quantify total loss. That might mean comparing vendor payment records against actual deliveries, reconciling bank deposits against reported revenue, or finding fictitious employees on a payroll. The goal is twofold: prove that fraud occurred and pin down how much money was taken.
Interviewing Witnesses and the Subject
Interviews do three things: gather background, corroborate what the documents show, and, ideally, produce an admission from the subject. Order matters. Experienced examiners work from the outside in, starting with people who have no involvement and finishing with the subject.
Neutral and Corroborative Witnesses
The earliest interviews are typically with neutral third parties: administrative staff who handle records, IT personnel who manage system access, or accountants who process transactions. These conversations establish how things are supposed to work, including the normal procedures, approval chains, and access controls. With that baseline, the examiner moves to corroborative witnesses, people who can confirm or deny specific facts the documents suggest. A vendor who was supposedly paid. A supervisor who supposedly approved a transaction. A colleague who worked alongside the subject during the relevant period.
The Subject Interview
The interview with the suspected perpetrator is the most sensitive step and should not happen until the examiner has assembled substantial evidence. Going in too early, before you can present specific facts, gives the subject room to build explanations that fit whatever partial picture is revealed. The goal is to lay out enough documented evidence that denial stops being viable, while staying professional and non-accusatory. What the examiner is listening for is either an explanation that the evidence did not anticipate or an admission that confirms the findings.
Upjohn Warnings in Corporate Investigations
When lawyers are involved in an internal investigation, employees being interviewed face a common misunderstanding. They may assume the company’s attorney is also their attorney. The Supreme Court addressed this in Upjohn Co. v. United States, which held that attorney-client privilege in a corporate investigation belongs to the company, not the individual employees.5Legal Information Institute. Upjohn Co. v. United States, 449 U.S. 383 In practice, the company can later decide to share what employees said with regulators or prosecutors. To prevent confusion and protect the privilege, corporate counsel routinely delivers what is called an Upjohn warning before an interview: the lawyer represents the company, not you; the conversation is privileged, but the privilege belongs to the company; and the company may choose to disclose what you say. Professional ethics rules require attorneys to clarify their role when an unrepresented person might reasonably believe the lawyer is looking out for their interests.
The Written Report
The examination ends in a written report that becomes the official record of what the investigation found. A well-structured report is what allows an organization to act on findings rather than sit on a pile of evidence it cannot effectively use.
Standard components include:
- Background: why the examination was conducted, who authorized it, and what triggered it.
- Scope: what the examination was designed to determine and any boundaries placed on it.
- Methodology: documents reviewed, analyses performed, and people interviewed.
- Findings: the detailed factual narrative of what happened, tied to specific evidence. This is the core of the report and often runs several pages.
- Financial impact: the quantified loss, traced through the evidence.
- Recommendations: control improvements to prevent recurrence. Optional but frequently requested by management.
The report has to draw a sharp line between established facts and the examiner’s opinions or inferences. Conclusions must be supported by evidence that is relevant, reliable, and sufficient, a standard the ACFE Code explicitly requires. A report that blurs facts and beliefs will be torn apart in any legal proceeding.
Distribution should be tightly controlled. Circulating findings too broadly can expose the organization to a defamation claim if the subject is not ultimately found liable, or undermine legal privilege if the investigation was conducted under attorney direction. Most organizations limit initial distribution to senior management, legal counsel, and, where a criminal referral is planned, law enforcement.
What Happens After the Report
Once the report is submitted, the organization chooses among three paths, and they are not mutually exclusive.
- Internal discipline, such as termination or demotion. Fastest resolution, but recovers no money.
- Civil litigation to recover the stolen funds. The examination report and underlying evidence form the backbone of the case.
- Criminal referral to law enforcement or a prosecutor’s office. The organization loses control of the timeline and outcome but gains criminal penalties as leverage.
The fraud examiner’s role does not necessarily end with the report. In civil litigation or criminal prosecution, the examiner often serves as an expert witness under Federal Rule of Evidence 702, which allows a witness qualified by knowledge, skill, experience, training, or education to testify as an expert when the opinion rests on sufficient facts, reliable methods, and a sound application of those methods.6Legal Information Institute. Federal Rules of Evidence Rule 702 – Testimony by Expert Witnesses
Insurance Recovery Through Fidelity Bonds
Many organizations carry fidelity bonds or employee dishonesty insurance, and filing a claim should be one of the earliest considerations once fraud is confirmed. These policies cover actual losses from dishonest acts of employees, though they generally do not cover speculative or intangible damages. Notice requirements are strict. Most policies require the organization to notify the carrier as soon as it becomes aware of the loss, and proof-of-loss documentation often has to be filed within a defined window. The examination report and supporting evidence form the core of the claim submission. Delaying notice risks denial.
Tax Treatment of Fraud Losses
Businesses and individuals engaged in profit-seeking activities can deduct theft losses on their federal tax returns. The IRS defines a qualifying theft as the taking of money or property with criminal intent under the law of the state where it occurred. The deductible amount is generally the adjusted basis of the stolen property, reduced by any insurance reimbursement or salvage value. Losses are reported on IRS Form 4684, with Section B covering business or income-producing property. For individuals whose losses are personal rather than business-related, deductions are available only if the theft is connected to a federally declared disaster, a restriction in place since the 2017 Tax Cuts and Jobs Act.7Internal Revenue Service. Topic No. 515, Casualty, Disaster, and Theft Losses Special rules apply to losses from Ponzi-type investment schemes.
Whistleblower Protections
Because tips are the single most common way fraud is detected, anyone involved in an examination should understand the protections available to people who report wrongdoing. Federal law prohibits publicly traded companies from retaliating against employees who provide information about conduct the employee reasonably believes violates federal fraud statutes or SEC rules. Protected activity includes reporting to a federal agency, a member of Congress, or a supervisor within the company. Retaliation such as firing, demotion, suspension, threats, or harassment entitles the employee to reinstatement, back pay with interest, and compensation for litigation costs and attorney fees.8Office of the Law Revision Counsel. 18 USC 1514A – Civil Action to Protect Against Retaliation in Fraud Cases
The SEC’s whistleblower program also offers financial incentives. When a tip leads to enforcement action producing sanctions over $1 million, the whistleblower can receive between 10 and 30 percent of the money collected.9U.S. Securities and Exchange Commission. SEC Issues $24 Million Awards to Two Whistleblowers For an organization opening a fraud examination, how it treats the person who raised the alarm can become its own legal exposure, on top of the underlying fraud itself.