An internal fraud investigation is a structured, confidential examination of whether someone inside your organization deliberately deceived it for personal gain. Done well, it starts with a written plan, preserves evidence so it can be used later, and is run by people who are independent of the suspect. Done badly, it tips off the person involved, contaminates the evidence and exposes you to legal risk. This guide covers the categories of fraud, the steps, the evidence rules, who should lead, and where outside investigators fit.
TL;DR
- Internal fraud falls into three broad groups: false financial statements, theft of assets and corruption. Knowing which one you face shapes the whole investigation.
- Plan before you act. Define scope, team, timeline and how data will be collected and preserved, then revise the plan as facts emerge.
- Evidence must be specific, relevant and authentic, with an unbroken record of who handled it.
- Involve legal counsel early, because privilege and confidentiality are easy to lose.
- Bring in outside investigators when the matter needs independence, surveillance, interviews or work across borders.
Table of Contents
- What counts as internal fraud
- Early warning signs and detection
- The investigation process, step by step
- How long does an internal fraud investigation take?
- What good evidence looks like
- Surveillance in an internal fraud case
- Who should lead the investigation
- Confidentiality and avoiding a second problem
- Hiring former FBI staff for advice
- Hiring ex-military investigators, including former SAS soldiers
- Finding people anywhere in the world
- Perspective: why outside investigators belong in the plan
- How we can help
- FAQ
- Sources
What counts as internal fraud
Internal fraud is committed by someone who works for, or is trusted by, the organization: an employee, manager, executive or contractor. The NCUA’s examiner guidance on internal fraud describes three ways insider financial fraud is carried out: fraudulent financial statements, misappropriation of assets and corruption.
In practice those categories look like this:
- Misappropriation of assets: cash skimming, fake vendors, inflated expense claims, ghost employees on the payroll, or inventory that quietly disappears.
- Fraudulent financial statements: inflating revenue, hiding liabilities or manipulating accounts so results look better than they are.
- Corruption: kickbacks, undisclosed conflicts of interest and bribery in purchasing or hiring.
The NCUA guide gives examples from financial institutions, including fictitious loans, check kiting and the manipulation of suspense accounts. The details differ by industry, but the pattern is the same: someone with access and trust bends a process for their own benefit.
If your concern is narrower, we have dedicated guides on employee theft investigations and payroll fraud.
Early warning signs and detection
Most internal fraud is not found by a dramatic discovery. It surfaces through small inconsistencies: reconciliations that never quite balance, an employee who never takes leave, vendors nobody can verify, or a manager who resists having anyone else look at their records.
Detection works best when it is built in rather than bolted on. The ACFE’s 2024 Report to the Nations, as summarized by the Anti-Fraud Collaboration, found that organizations with external audits in their anti-fraud programs had losses 52% smaller and caught frauds twice as fast as those without audits.
Good control design also assumes that senior people can be the problem. The COSO fraud risk guidance, discussed by Norton Rose Fulbright, recommends combining preventive and detective controls, using data analytics and allowing for the possibility that management overrides the controls.
Practical detection habits include:
- Dividing duties so no one person can approve, pay and reconcile the same transaction.
- Running spot checks and vendor reviews.
- Offering an anonymous way to report concerns.
- Comparing payroll, vendor and bank data for records that do not match.
The investigation process, step by step
Professional bodies describe the process in similar terms. The ACFE’s Fraud Examiners Manual describes a fraud examination as resolving allegations from inception to disposition, which can include obtaining evidence, reporting, testifying and helping with prevention. Here is how that translates to a working sequence.
1. Assess the allegation
Before anything formal begins, decide whether the allegation is credible enough to justify an investigation. The Institute of Internal Auditors’ guide to fraud examinations starts with assembling a small team to brainstorm and plan, then making that assessment. Keep the circle tight. Every extra person who knows is a risk to confidentiality.
2. Write the plan
Jones Day’s guidance on corporate internal investigations recommends a work plan covering objectives, anticipated scope, team members, and tasks such as documents to review, witnesses to interview, financial analysis and legal research, with named responsibility for each.
The plan is not fixed. Cleary Gottlieb’s crisis management handbook calls it a living document that is modified once work begins, and it lists scope, goals, oversight and timeline as core components. The ACFE manual makes the same point: planning is ongoing and the team refines it as the facts change.
3. Secure and collect evidence
The collection phase should come before any confrontation. Typical tasks include identifying who holds relevant records, working with IT to collect and preserve email and files, and choosing a forensic collection method for electronic data. Cleary’s handbook adds that you should keep a record of the chain of custody. We explain why that matters in our guide to chain of custody and admissible evidence.
4. Interview and analyze
The IIA’s field work phase covers interviews, fact-finding and securing documents and equipment. Analysis then tests transactions for accuracy, looks for a clear sequence of events, reconstructs patterns from data and checks interviews against each other for corroboration.
5. Report and act
The ACFE manual says the examiner reports findings, and recommendations where appropriate, to designated people such as management, the board or the audit committee. Decisions about discipline, recovery, insurance and referral to police come after that report, not before it.
How long does an internal fraud investigation take?
There is no reliable standard length. A single expense-claim problem with clear records can be resolved quickly, while a scheme that runs across years, several accounts or multiple countries takes much longer. Three things drive the timeline more than anything else:
- Scope: how many people, accounts, systems and years are involved.
- Data access: how quickly records can be preserved and reviewed, and whether they sit in one place or many.
- Cooperation and legal steps: whether witnesses are available and whether police or regulators are involved.
Set an anticipated timeline in the plan, as the Cleary handbook advises, and revisit it when the scope changes. Any investigator who promises a fixed end date before seeing the records is guessing.
What good evidence looks like
Evidence has to survive scrutiny from a lawyer, a tribunal or a judge. Aim for material that is specific, relevant, competent and authentic. That means:
- Original records, not summaries. Keep bank statements, invoices, system logs and emails in their native form.
- Forensic copies of devices and data. Do not browse a suspect’s laptop and change timestamps in the process.
- A custody log. Record who collected each item, when, and where it has been stored.
- Contemporaneous notes. Interview notes should be written at the time and reviewed for accuracy.
Photographs and video from lawful surveillance can corroborate what documents suggest, for instance an employee claiming to be sick while working elsewhere. That evidence only helps if it was gathered within the law, which brings us to the rules on monitoring staff.
Surveillance in an internal fraud case
Documents tell you what was recorded. Surveillance shows what a person actually did. In internal cases it is most useful when the allegation concerns conduct outside the records: working a second job while on paid leave, meeting a supplier who is paying kickbacks, or misusing company property and time.
Surveillance should be targeted and proportionate. It should be planned around a specific allegation, run by trained operators and documented so photos and video are court-ready. Our Surveillance service is published at $1,000 to $1,450 one-off, and the page explaining private investigator costs sets out what goes into that figure. For surveillance of staff inside your own workplace, such as cameras, email and device monitoring, read what employers can legally monitor first, because the rules vary by jurisdiction and notice requirements apply.
Who should lead the investigation
The uncomfortable truth is that the people closest to the problem are often the worst placed to investigate it. A manager may be friends with the suspect, or may be implicated. HR may lack forensic skills. Internal audit may not have the experience either: one widely read guide on fraud and internal audit warns that internal auditors should not investigate fraud without specific experience and expertise.
Sensible structures usually combine:
- Legal counsel to direct the work and protect privilege.
- Forensic accountants for financial analysis.
- IT specialists for data preservation.
- Independent investigators for interviews, surveillance, asset tracing and field inquiries.
Privilege and legal counsel
The Association of Corporate Counsel’s article on reporting employee theft or fraud, written from an Australian perspective, explains that an investigation aimed at finding failures in internal controls can be discoverable in later proceedings, while one undertaken in contemplation of civil proceedings against the employee can be protected by legal professional privilege. It advises engaging external lawyers early. Clayton Utz makes a related point in its checklist for general counsel: structure the work so reports are privileged, with lawyers directly engaging any forensic accountants or investigators.
Privilege rules differ between countries and states. If you operate in the United States, ask your own counsel how privilege applies to your situation before you engage anyone.
When to involve police
The ACC article notes that if a crime is reported, police have greater investigative powers, and the organization should assist without interfering. It also notes that in Australia the obligation to report crime varies: New South Wales imposes a statutory duty for serious indictable offences, while other jurisdictions generally do not, and failing to report can hinder recovery under a fidelity insurance policy. Check your own jurisdiction and your insurance policy before deciding.
Confidentiality and avoiding a second problem
A fraud inquiry can go wrong in ways that have nothing to do with the fraud. A leaked allegation can damage an innocent person’s reputation. A hasty dismissal can create a claim against you. Protect against both:
- Limit information to those who need it and keep physical evidence locked away.
- Store digital material in encrypted files or a secure case platform with role-based access.
- Apply fair process: put allegations to the person, record their response and keep an open mind until the evidence is in. Our guide to terms of reference for workplace misconduct shows how to keep HR decisions fair.
- Report progress to the board or CEO at regular intervals, as Clayton Utz recommends, while protecting the integrity of the evidence for any later civil or criminal case.
Hiring former FBI staff for advice
Many business owners ask whether they should bring in someone with a federal law enforcement background. The value is real: experience in complex financial crime, structured interviewing, evidence handling and working with prosecutors. The FBI itself describes corporate fraud, including accounting schemes and self-dealing by executives, as a focus of its financial crime work.
What a former agent adds to your case is judgment about how an investigation will look from the other side of the table: what a prosecutor needs, how a defense lawyer will attack your evidence, and where a case is likely to fall apart. Our team includes former FBI and military investigators, and you can read about that side of our work on our former FBI agent page. An advisory conversation early, before you confront anyone or touch any records, is often the cheapest part of the whole process.
Hiring ex-military investigators, including former SAS soldiers
People with special forces backgrounds, such as former SAS soldiers, are sometimes sought for sensitive work. What transfers well to investigation is discipline, patience, planning and the ability to stay unnoticed and calm over long periods. Those are exactly the qualities that make surveillance reliable.
When you hire anyone with a military background, though, look at the whole picture: investigative training, knowledge of the law on evidence and privacy, report-writing, and a clean record of lawful work. A tough résumé alone does not make evidence admissible. Our investigators come from ex-police, ex-military and polygraph backgrounds, and we combine that experience with technology that produces court-ready photos and video. If you have a specific background in mind, tell us when you enquire and we will explain who on our team is suited to your matter.
Finding people anywhere in the world
Internal fraud often ends with a question: where did the money, or the person, go? A former employee may have relocated overseas, a supplier may exist only on paper in another country, or a director may have moved assets abroad. Locating people across borders depends on lawful methods: public records, open-source and social media research, interviews, and contacts with investigators on the ground.
We have handled this kind of work for clients, for example in a case where we located a missing person in the UK. Related work includes social media investigation and asset searches to trace what has been moved. Each country has its own privacy and data rules, so a lawful approach in one place can be unlawful in another. That is why an experienced investigator plans a cross-border search before starting it.
Perspective: why outside investigators belong in the plan
In our experience, the owners who recover best from internal fraud are the ones who slow down at the start. They resist the urge to confront, preserve the records first and bring in independent eyes before the suspect knows anything is happening.
We built Pi Melbourne around tailored investigations because no two internal cases look alike. A ghost employee, a supplier kickback and an employee working elsewhere while on leave each need a different mix of document work, interviews and surveillance. Our investigators are former police, military and polygraph specialists, including former FBI personnel, and they gather photos and video designed to stand up in legal proceedings.
Our advice is to treat an investigator as part of the team with your lawyer and accountant, not as a last resort. We work to your scope, keep the matter discreet and document everything so your decisions rest on evidence rather than suspicion.
P.i Melbourne
How we can help
If you suspect fraud inside your business, we can scope the matter with you, run lawful surveillance, interview witnesses, trace assets and prepare evidence for your lawyer. Our services cover corporate investigations, staff monitoring, fraud investigation, and Victorian WorkCover investigations. Small businesses can also see our guide to fraud in small business.
To discuss your situation in confidence, start at our private investigation services page or contact us through Pi Melbourne.
FAQ
What are the three main categories of internal fraud?
The NCUA’s examiner guidance names fraudulent financial statements, misappropriation of assets and corruption. Asset theft is the most common in small businesses and includes skimmed cash, fake invoices and payroll schemes. Corruption covers kickbacks and undisclosed conflicts of interest.
What happens during a fraud investigation?
The team assesses the allegation, writes a plan, preserves and collects evidence, interviews witnesses, analyzes records and then reports to management or the board. Decisions on discipline, recovery and police referral follow the report. The plan is revised as facts emerge.
How long does a fraud investigation usually take?
It depends on scope, access to data and whether police or regulators are involved. A simple case with clear records moves fast, while a multi-year or cross-border scheme takes much longer. A good investigator sets a timeline in the plan and updates it as the work develops.
Should I confront the employee first?
No. Preserve records and take advice from your lawyer before anyone is approached. Confronting someone early can lead to deleted files, destroyed evidence and legal exposure if the allegation turns out to be wrong.
Sources
- NCUA Examiner’s Guide: Internal Fraud
- Anti-Fraud Collaboration: Fighting Fraud, A Shared Responsibility
- Norton Rose Fulbright: COSO’s new fraud risk management guidelines
- ACFE Fraud Examiners Manual: Planning and Conducting a Fraud Examination
- Institute of Internal Auditors: How to conduct fraud examinations
- Jones Day: Corporate Internal Investigations work plan
- Cleary Gottlieb: Conducting an Internal Investigation
- Association of Corporate Counsel: Reporting Employee Theft or Fraud
- Clayton Utz: Responding to fraud, a practical checklist for general counsel
- FBI: White-Collar Crime