internal fraud investigation

A tip lands in the hotline inbox: a vendor that nobody seems to have met is getting paid every month, and the approvals all trace back to one manager. What you do in the next 48 hours will decide whether you recover money, protect your people, and keep regulators on your side, or whether the evidence quietly disappears.

The stakes are real. The Association of Certified Fraud Examiners’ Occupational Fraud 2026: A Report to the Nations analyzed 2,402 cases from 143 countries and found a median loss of $104,000 per case, with organizations losing an estimated 5% of revenue to fraud each year. A typical scheme ran 12 months before detection, and 43% of cases were caught through a tip, more than half of them from employees.

Tips start investigations. A clear framework finishes them. Here is a five-step internal fraud investigation process any organization can adapt.

Step 1: Triage the Allegation and Set the Scope

Not every complaint needs a full internal fraud investigation, but every complaint needs a documented decision.

  • Assess credibility. Is the tip specific (names, dates, amounts) and consistent with records you can check quietly?
  • Define the question. Write a short scope statement: what allegedly happened, when, and what you need to prove or disprove.
  • Pick the team. Keep it small and independent. Remove anyone who reports to, or works closely with, the subject.
  • Involve counsel early. In Upjohn Co. v. United States (1981), the Supreme Court held that attorney-client privilege can cover employee communications with corporate counsel during an internal investigation. Bringing in a lawyer at the start helps protect the work.

If the allegation involves senior executives, the board or audit committee should oversee the internal fraud investigation, not management.

Step 2: Preserve Evidence Before Anyone Knows

Evidence is most vulnerable early in an internal fraud investigation. Move before the subject has a reason to delete anything.

  • Issue a legal hold for relevant emails, chat messages, accounting records, and shared drives
  • Have IT capture device images and system access logs, and keep a chain-of-custody record
  • Suspend, rather than wipe, accounts and devices of departing employees
  • Restrict knowledge of the investigation to the core team

Digital evidence often makes or breaks a case. Our digital forensics coverage shows how investigators use it in practice.

Step 3: Follow the Documents and the Data

Start with the paper trail before you talk to anyone, so your interviews are grounded in facts.

  • Pull the transaction history. Vendor master files, payment runs, expense reports, payroll changes, and journal entries.
  • Run analytics. Look for duplicate payments, round-dollar invoices, vendors sharing employee addresses or bank accounts, and approvals outside business hours. Our guide to data analytics in fraud detection covers the techniques.
  • Trace the money. Follow funds from your accounts to where they ended up. Money laundering basics explains how investigators trace layered transactions.
  • Build a timeline. Map each transaction against who had access and approval authority at the time.

Step 4: Conduct Interviews the Right Way

Interviews confirm what the evidence suggests. Sequence matters.

  1. Start on the outside. Interview witnesses and neutral employees first, then people closer to the activity, and the subject last.
  2. Use two interviewers. One asks questions; the other takes notes.
  3. Give an Upjohn warning when counsel is involved. Explain that the lawyer represents the company, not the employee, and that the company controls the privilege.
  4. Document promptly. Write a memo the same day.

If an outside firm conducts interviews, know the rules. Under the Fair Credit Reporting Act, communications made to an employer to investigate suspected workplace misconduct are excluded from the definition of a consumer report when certain conditions are met, but if you take adverse action based on them, the employee must receive a summary of the findings.

Step 5: Report, Remediate, and Decide on Disclosure

An internal fraud investigation ends with decisions, not just findings.

  • Write a factual report. Stick to evidence, avoid conclusions about intent you can’t support, and share it only with those who need it.
  • Act consistently. Discipline, termination, civil recovery, and law enforcement referral should follow policy. In the ACFE’s 2026 data, 68% of perpetrators were terminated and 54% of cases were referred to law enforcement.
  • Fix the control gap. A real case shows why. A Texas business manager pleaded guilty in 2020 to stealing more than $470,000 using company credit cards issued in the names of former employees. Closing accounts when people leave would have cut off the scheme.
  • Weigh self-disclosure. In March 2026, the Department of Justice issued its first department-wide Corporate Enforcement and Voluntary Self-Disclosure Policy. Companies that promptly self-disclose, fully cooperate, and remediate, with no aggravating factors, receive a declination. If a whistleblower reports to both the company and DOJ, the company has 120 days to self-report to keep that path open.

Internal audit has a role here too. The IIA’s Global Internal Audit Standards took effect on January 9, 2025, and audit teams should feed investigation lessons into future risk assessments.

Turn One Investigation Into a Stronger Program

A disciplined internal fraud investigation protects whistleblowers, treats accused employees fairly, and shows regulators your controls work. Write your framework before the next tip arrives.

Start by making sure people can report concerns safely: here’s how to build a whistleblower hotline employees actually use. Then explore how real schemes unfold in our Case Files and corporate embezzlement coverage, or contact FraudOrder with questions.

Frequently Asked Questions About Internal Fraud Investigations

Who should lead an internal fraud investigation?

Someone independent of the people and processes involved, often compliance, internal audit, or legal, with outside counsel or forensic accountants for serious matters. If senior leaders are implicated, the board or audit committee should oversee it.

Should we involve a lawyer from the start?

For most significant allegations, yes. Counsel can help protect privileged communications, advise on employment and disclosure issues, and reduce the risk of missteps that weaken your position later.

Can we tell the accused employee about the investigation?

Usually not until evidence is preserved and the key records are reviewed. Alerting the subject too early can lead to deleted files or coordinated stories. Counsel can advise on timing and any notice obligations.

How long does an internal fraud investigation take?

Every internal fraud investigation differs. A simple expense fraud may take weeks, while multi-year vendor or financial statement schemes can take months.

Do we have to report fraud to law enforcement?

Not always, but some situations and industries carry reporting obligations, and DOJ’s 2026 policy rewards prompt voluntary self-disclosure. Discuss referral and disclosure options with legal counsel.

What evidence matters most?

Contemporaneous records: transactions, approvals, emails, and system logs. Interviews add context, but documents and data usually carry the most weight.

References

  1. Association of Certified Fraud Examiners. (2026). Occupational fraud 2026: A report to the nations. https://www.acfe.com/report-to-the-nations
  2. Accounting Today. (2026). Organizations lose 5% to fraud each year. https://www.accountingtoday.com/news/organizations-lose-5-to-fraud-each-year
  3. Dean Dorton. (2026). ACFE’s 2026 Report to the Nations highlights ongoing fraud risks for organizations. https://deandorton.com/articles/acfes-2026-report-to-the-nations-highlights-ongoing-fraud-risks-for-organizations/
  4. Jones Day. (2026). DOJ announces new corporate enforcement policy with broader reach. https://www.jonesday.com/de/insights/2026/03/doj-announces-new-corporate-enforcement-policy-with-broader-reach
  5. Legal Information Institute, Cornell Law School. (1981). Upjohn Co. v. United States, 449 U.S. 383. https://www.law.cornell.edu/supremecourt/text/449/383
  6. Legal Information Institute, Cornell Law School. (n.d.). 15 U.S. Code § 1681a: Definitions; rules of construction. https://www.law.cornell.edu/uscode/text/15/1681a
  7. The Institute of Internal Auditors. (2025). The IIA celebrates the effective date of the Global Internal Audit Standards. https://www.theiia.org/en/content/communications/press-releases/2025/january/the-iia-celebrates-the-effective-date-of-the-global-internal-audit-standards/
  8. U.S. Attorney’s Office, Western District of Texas. (2020). Former Schertz business manager pleads guilty to stealing over $470,000 from company. https://www.justice.gov/usao-wdtx/pr/former-schertz-business-manager-pleads-guilty-stealing-over-470000-company

Disclaimer

This article is for informational purposes only and is not legal, financial, or professional advice. Reading it does not create a client relationship. Consult qualified legal and forensic professionals about your specific situation. For questions about FraudOrder services, visit https://fraudorder.co/