Corporate & White Collar Investigations

Crime has become syndicated, specialised, and criminal activities have become part of businesses posing as professional entities in various service lines such as fuel and oil, mining, and retail.  It became increasingly important to concentrate on proactive investigations, especially as individuals operate in well-established organized crime syndicates.

Any entity (client) will conduct business with other entities as their customers and/or vendors, and such business/es might require time to make time for fraud consideration/s in your area of business/es. An effective program to vet and onboard new business customers and vendors is a critical component of a comprehensive fraud risk management program.

To help business owners have visibility into these risks and benchmark their own processes for screening and onboarding other businesses, the ACFE and Thomson Reuters partnered on a study to explore the risks and controls related to business-to-business transactions and relationships.  A study to explore the risks and controls related to business-to-business transactions and relationships was done, and the results thereof are available (Combatting business-to-business fraud:  benchmarking report)

A forensic investigation can only commence after the signing of a mandate by the client.  The mandate will refer to the scope of work, and the forensic investigators must indicate what their approach will be to provide these services.

The information and evidence gathered by the corporate investigators becomes the property of the party (client) on whose instruction the investigation was conducted and who mandated the investigation.  All information and evidence must be legally obtained, and the corporate investigator must limit the investigation to the approved mandate.

The investigator should share a detailed planning document with the client and also a request for the sourcing of documentation and data (RFI).  The investigator should also include an experienced team in the matter so that all aspects of the mandate can be fulfilled.  The investigator must ensure that relevant evidence is sourced that can prove or disprove any of the matters reflected in the scope of work.  Relying on evidence that may ultimately be ruled as irrelevant in subsequent legal proceedings could seriously undermine an engagement.

Upon completion of the investigation, the investigator submits the result of the investigation to the client in a forensic report supported by the evidence sourced during the engagement.  The decision of what to do next lies with the client after consideration of the findings, conclusions, and recommendations made by the investigator.

All evidence must be sourced, must be relevant to the scope of work and sourced in terms of the law of evidence.  When considering how individuals use computers and mobile devices such as smart phones, it is understandable that traces of almost all their work and communication with clients, etc can be found in the data on these devices.  All evidence uncovered during the engagement, by way of consultations, profiling of individuals, review of for instance transactional documentation and digital evidence must be considered and inserted in a forensic report.  The report may be used in a court subject to the agreement with the client and the purpose of the report.

The business should consider appointing forensic investigators to determine whether fraud indeed occurred and should consider the outcome of the investigation that will be reflected in the findings, conclusions and recommendations of a forensic report.  The business can consider civil, labour and criminal litigation during the engagement and the forensic report can be relevant in these litigation proceedings.

CDH can assist the client by providing proactive forensic services, including fraud risk assessments, lifestyle assessments of staff, including senior staff and board members.  It is also important to provide a client with value-added recommendations as we can identify shortcomings in systems during forensic investigations. 

We conduct forensic investigations in the division in order to assist clients to:

• identify improper conduct of employees and/or service providers and/or other individuals and/or legal entities;
• identify the person/s responsible for improper conduct;
• stop illegal activities such as fraud;
• determine the extent of potential liabilities or losses that might exist;
• help facilitate the recovery of losses;
• stop future losses;
• mitigate other potential consequences; and
• strengthen internal control weaknesses.

Financial investigations that are done in a structured and integrated way that combines tried and tested investigation techniques such as investigative interviewing, using available sources of information with the gathering of evidence, the gathering of exhibits and then combine the process with traditional accounting and auditing practices to investigate the financial affairs and positions of a suspect with the aim of addressing either money laundering or the proceeds of crime.

• During financial investigations, we focus on the proceeds of crime. It includes asset forfeiture, financial intelligence, investigation of suspicious transactions and financial profiling.
• A trail of documentation and/or information is usually left by suspects who can provide relevant information to the investigation. The following becomes relevant:
  • The making of a direct comparison where record of businesses that have historical connection with suspects or criminals are concerned, are examined;
  • The comparison of income against expenditure. The income and expenditure are compared and unidentified cash is questioned; and
• The net- worth of the suspect is investigated – the net-worth is assets minus liabilities. Any increase in the net-worth must have a reason for instance increase in salary, business operations or proceeds. The suspect’s spending habits can perhaps appear to include high personal living expenses, the acquisition and disposal of real estate, jewelry, movable assets, bank accounts, life insurance policies having a cash value and periodic reduction of mortgage loans.
• It is important to conduct the investigation of the crime and the financial investigation simultaneously. The money will then afterwards be traced.
• Controls are not always effective, resulting in malicious users or programs gaining access to controlled systems. Employees who perform fraudulent activities might go to great lengths to hide their transgressions through data modification or creative accounting. Sometimes unauthorized external access to a system is easily detectable, but sometimes hacking leaves no trace of the security breach.

Investigations into misconduct and unethical conduct. Every entity should have firm commitment to integrity in all behavior. In instances where unethical conduct such as fraud and corruption is suspected and/or experienced, a zero-tolerance approach should be pursued by the public and private sectors.

• Such conduct is investigated and followed up by the submission of all remedies available within the full extent of the law and the implementation of suitable prevention and detection controls. We therefore consider prevention controls including existing financial and other controls and checking mechanisms as prescribed in legislation policies and procedures.
• The management of a company should reflect integrity, which is a prerequisite for ethical behavior in all activities. Formal codes of corporate conduct are important as a foundation and an indication of irregularities are behavioral issues, conflicts of interest, illegal or otherwise improper payments and anti-competitive arrangements.

Investigations into labour related matters as well as whistleblower allegations and/or reports.  These services include an investigation into:

• Compliance with ethical standards, whether or not embodied in a written code of conduct, is best ensured by management’s actions and the examples set. Mechanisms should exist to encourage employee reporting of suspected fraud, corruption and theft and disciplinary actions should be instituted against employees who fail to report such violations.

We conduct profiling on behalf of our clients. The proceeds of crime are usually converted into assets, which are hidden. Rather than hoard the proceeds of their acts, subjects may spend lavishly on conspicuous items such as cars, homes, clothing and jewelry. Being alerted to changes in spending patterns and to observations from customers, employees and anonymous tips will often lead investigators to hidden assets.

• A personal financial profile is, in essence, a modified financial statement showing what a subject owns, owes, earns and spends at any given time, or over a period of time. It can yield direct or circumstantial evidence of illegal income or hidden assets indicating that the subject cannot afford the lifestyle he/she is leading.

• The profile gives a financial picture of the subject and should be as thorough as possible to prevent it from being contested on the grounds that something was left out. The profile will later serve as the foundation for the tracing and recovery of assets.
• Information gathered during the compiling of a detailed profile will assist and create a picture of the specific individual and consultations are also conducted to verify the sourced information.

We conduct forensic accounting investigations that can be defined as the use of professional accounting skills in matters involving potential or actual civil or criminal litigation. The forensic accounting is actually litigation support involving accounting. 

Our investigations in forensic computer and cybercrime include the detection and investigation of malicious applications and custom developed solutions. The primary goal of this type of investigation is to recover information, (both overt and covert), that is pertinent to an investigation and prosecution of the criminal activity being investigated. The objective is to obtain copies of relevant computer records, without in any way altering the contents of the computer upon which those records are stored.

We will follow our internal processes to report the matter to the risk committee and then source all relevant evidence to the allegations.  After conclusion of an investigation, the findings, conclusions and recommendations will be considered by CDH. 

The legal obligations are vested in the client. If the client does not adhere to relevant legislation, then we (CDH) will be obliged to report as required by specific legislation. A client must always consider legislation and report to the regulatory authorities accordingly.

A client should adhere to reporting obligations and institute internal or external investigations to source the evidence in support of fraud allegations. Action must be taken including consequence management processes, and a client should also ensure that they do proper due diligence on venders and other entities with how they want to do business.

Conduct fraud risk assessments and have a whistleblower process in place for employees and contractors to report fraud and related offences.

CDH can work with the internal investigators as they will have institutional knowledge and can assist with the sourcing of documentation and data.  It is, however, important for CDH to conduct the investigation independently and to adhere to the approach and guidelines as provided by the ACFE. CDH can assist with skills development of the internal forensic team within the guidelines of an approved mandate.