72 Hours to Get it Right: The Clock is Ticking on Your Investigation

You have probably heard the phrase, “Proper planning prevents poor performance.” That is how one of the session panelists introduced the 34th Annual ACFE Global Fraud Conference session, “72 Hours to Get it Right, Sponsored by FORVIS,” which focused on the role of timeliness when it comes to fraud investigations. FORVIS forensics and valuation services professionals Erik Lioy, CFE, CPA/CFF, Zachary Powers, and Pat Hoan, CFE, CPA, wanted to prove that the actions taken by fraud investigations in the first three days after a potential fraud is uncovered play a crucial role in the direction of the investigation.

The 72-hour timeline the panelists presented involved five parts:

  1. Prior to incident

  2. Zero hour

  3. First 24 hours

  4. First 48 hours

  5. First 72 hours

The time prior to an incident is the perfect time to minimize risks before fraud occurs. Tone at the top, anti-fraud training and the previous handling of known fraud can all serve as preventative controls. Having detective controls in place is also helpful, which can include performance reviews or surprise audits. Organizations should also have policies in place for fraud and insurance coverage, should any such instances occur.

Lioy emphasized how crucial setting up whistleblower hotlines for tips is, citing a statistic from Occupational Fraud 2022: A Report to the Nations, which says 43% of frauds are uncovered by tips. He asked the in-person audience for a show of hands if their organization only had whistleblower hotlines open to organization employees. As many people raised their hands, Lioy noted how that needed to change. He said opening whistleblower hotlines to outside reporting for vendors, suppliers, disgruntled ex-spouses, and more, as well as posting those whistleblower hotline details in many places, like websites or vendor contracts, will help uncover even more tips that could lead to fraud. By providing these controls early on, costs are much lower compared to an investigation later.

The zero hour is all about being proactive and developing a response to potential fraud, as opposed to simply reacting to the incident. The main takeaway reiterated by the panelists is that this is not a time to panic. Instead, investigators should gather as much information about the potential fraud incident but keep an open mind about how these facts could develop differently throughout the course of the investigation. Investigators should protect that evidence for future investigation, but also keep in mind not to be quick to examine the evidence without a plan in place first. The zero hour is also the time to communicate with all team members who will be playing a role in the investigation. The panelists said investigators need to be decisive during this stage of the timeline.

Before the 24-hour period passes after a potential fraud case is discovered, a plan should be established. There are many questions that should be asked during this part of the process:

  • What is the objective?

  • Who are the stakeholders? In essence, stakeholders are anyone who will take an interest in what is uncovered in the investigation.

  • Is my team competent and independent? Basically, who will follow the chain of custody in this case?

  • How can resources be deployed?

Moving into the 48-hour period, investigators should be collecting evidence to develop the case. Investigators should determine an order of interviewing witnesses and determine if it’s worth the cost to conduct in-person interviews. When it comes to keeping paper documents well preserved, originals should be kept and handling should be minimized.

Finally, within the first 72 hours, investigators should remember to adapt and overcome. An investigation can change in an instant, and investigators need to be ready to change with it. The facts uncovered will help lead the course of the investigation from here. Investigators should also be mindful of circumstances beyond their control, including challenges involving data, resources and timing.