Don't gamble with your company's investigation process.

Learn about i-Sight software today

14 Tips for Effective Embezzlement Investigations

Organizations lose an average of $357,650 when an employee embezzles money. These tips for strong embezzlement investigations will help to protect your company.

Posted by Ann Snook on October 10th, 2019

A company victimized by embezzlement loses an average of $357,650. Even more alarming, they usually only recover about 39 per cent of that total.

With financial losses and potential reputation damage at stake, most organizations can’t afford to miss the signs and evidence of embezzlement. Use this guide to strengthen your workplace’s embezzlement investigation process so you don’t miss any key steps.


Download our free eBook to learn how case management software can help you conduct more effective embezzlement investigations.


1. Recognize the Signs


Before you start an embezzlement investigation, you have to recognize the signs of the crime. The ability to detect internal fraud is key to preventing future incidents.

First, look out for signs of embezzlement in your everyday business operations, including:

  • Missing financial documents: Embezzlers may destroy invoices, receipts or payroll records to hide evidence of their crimes.
  • Inconsistencies in accounting records: Unexplained imbalances (especially those beyond the typical margin of error) could indicate embezzlement.
  • Unusual financial activity: Employees make mistakes sometimes, but frequent instances of duplicate payments, altered checks or unusual transactions over an extended period of time could be a sign of embezzlement.


Employees’ behavior can also reveal embezzlement. Take note of signs such as:

  • Odd working hours: The employee stays late or comes in early day after day to conduct their fraud without other people around.
  • Not taking time off: An embezzler doesn’t want to risk evidence of their crime being found while they’re away, so they refuse to take vacations or other days off from work.
  • Working alone: Many employees prefer to work independently, but if someone insists on learning processes outside of their position and refuses help or task delegation, they may be hiding something.
  • Financial situation: Embezzlers may either express that they are in a bad financial situation (motivation) or start making indulgent purchases that are inconsistent with their salary (using stolen funds).


Download our helpful checklist to ensure you don’t miss any important steps in your fraud investigation.

2. Don’t Assume Guilt


Even if all of the signs above are present in your workplace, don’t make assumptions about which employees are guilty. Confronting employees as if they are guilty could lead to a toxic work environment at best and a defamation lawsuit at worst. If the employee turns out to be innocent, they’ll lose confidence in you as an employer and could sue; if they’re guilty, an accusation gives them time to destroy evidence before you can gather it all.


3. Keep It Confidential


As the first step of your embezzlement investigation process, make a list of every employee who had the access and opportunity to commit the fraud. Don’t discriminate based on length of tenure, salary or position. Once you’ve compiled your list of potential suspects, keep your suspicions quiet. Only reveal information that’s necessary to the embezzlement investigation process and never assign blame.

“Stop the bleeding” by figuring out the root cause of the fraud while maintaining privacy and confidentiality for the employees you think might be involved. Loose lips could compromise the investigation.


Download our free cheat sheet to learn about different tools you can use in your root cause analysis.


4. The Crime Determines What the Embezzlement Investigation Looks Like


As with any other type of investigation, there is more than one way to conduct an embezzlement investigation. The complexity of your case, as well as the number of people, amount of funds and methods used to commit the fraud, will determine how you investigate it.

What all embezzlement investigations have in common, though, is their objectives. According to the legal experts at Wildman Harrold, you should aim to:

  • Determine whether there was theft
  • Determine the total amount and method(s) of that theft
  • Remove fraudsters from your workplace and take preventive actions to reduce your risk of similar incidents in the future
  • Recover losses (funds, property, etc.)


5. Create an Investigation Plan


One of the worst things you can do is go into an embezzlement investigation without a plan. List all the tasks required to meet your investigation objectives and their deadlines. Compile a chronology of known facts as well as an interview schedule.

Keep in mind that an investigation plan should be a living document. Make changes where and when they’re necessary throughout the embezzlement investigation process.


Don’t know where to start? Download our free investigation plan template.

fraud policy

6. Collect Documents ASAP


As soon as you decide to launch an embezzlement investigation, start collecting physical and electronic financial records. Acting quickly reduces the risk of the fraudster destroying evidence of their crime. In addition to records, gather other relevant documents such as emails, notes, memos and messages that may reveal helpful information for your investigation.

As you collect documents, remember to keep the process confidential. As an added security measure, try to avoid emailing confidential information or files where possible. A case management system that stores all records right in the case file controls access to sensitive data and reduces your risk of lost or compromised evidence. Learn more about i-Sight for fraud investigations here.


7. Seek Expert Help


An embezzlement investigation can be one of the most complex types of workplace investigation. As a result, you may need to hire outside experts to help you. Forensic accountants and data retrieval specialists are trained to find evidence your team could overlook. When you’re investigating thousands or hundreds of thousands of dollars in losses, you don’t want to miss any key pieces of information.

It may be necessary to bring in outside experts to avoid tipping off the embezzler. This may also require that the evince gathering be done after hours.


8. Interview (and Interview Again)


Interviews are essential to uncover information that you might not find in documents and records. Interview everyone on the list you made, then follow up with those whose accounts are inconsistent with evidence or other employees’ statements.

When conducting interviews, be sure to keep them confidential and only reveal as much information as is necessary to the investigation. Avoid coercion, leading questions and subjecting interviewees to duress. Record or document each interview well. In addition, ask interviewees to sign written statements confirming their stories.


RELATED: 6 Steps to Preventing Embezzlement


9. Analyze the Evidence


After you’ve gathered evidence but before you come to a conclusion, analyze your findings. Not all information gathered during the embezzlement investigation process is high quality. Review physical evidence and interview notes, asking:

  • Is the information from a first-hand account or hearsay?
  • Does this information contradict or corroborate other evidence?
  • Is this information clear, detailed and logical?
  • What information is missing to create a whole picture of what occurred?


internal audit

10. Decide What Action to Take


When an employee commits fraud, your knee-jerk reaction might be to fire them. However, if they end up unemployed and/or in prison, it’s hard to recover your losses.

As an alternative, consider disciplinary action that can help you recoup some or all of the funds you lost. This could include withholding benefits, taking a percentage of their pay or asking for immediate payment back in cash. You may find it appropriate to put the employee on leave, too.

On the other hand, reporting the crime to law enforcement may be necessary. Calling the police on an employee can feel uncomfortable and may disturb the workplace environment for awhile. Still, when large amounts of funds were stolen or multiple employees were involved, you may need to take legal action.


11. Write an Investigation Report


After you’ve come to a conclusion, write it up in an organized investigation report. An investigation report shows your investigation process and proves that it was thorough and professional. If the accused employee challenges your methods, the report can be used as proof of a fair investigation. A record of the investigation also provides a guide for what to do if similar misconduct happens in the future.

Decision-makers can then use the findings and suggestions you list in the report to help them determine an appropriate course of action. You may also suggest changes to workplace policies and procedures that could correct and prevent future incidents in this report.

In addition to suggested courses of action, include information such as interviewees, evidence that was gathered and external experts you consulted plus their analysis.


12. Don’t Fear Self-Reporting


If fraud took place, it’s not enough to clean up the mess internally. By law, your organization is required to report to regulators and other external parties. Fearing fines, legal repercussions and reputation damage, you may be hesitant to reveal the embezzlement.

However, you’re better off reporting the crime than not. “When companies can demonstrate that a fraud case was carefully investigated—and that clear steps were taken to reduce the risk of similar future activity—senior leaders can be reasonably confident in a decision to self-report the event,” says John Tara, director of RSM US.


13. Perform a Risk Assessment


Sometimes it takes an internal incident to bring attention to threats and vulnerabilities in your workplace. You might think your policies, procedures and processes are working fine until an employee proves otherwise.

After you’ve concluded your investigation, perform a risk assessment. Figure out what changes you need to make to reduce your risk of further embezzlement (or other internal fraud). Then, amend internal documents and communicate the changes throughout the organization.


RELATED: Employee Embezzlement: The Ultimate Guide


14. Develop a Fraud Response Plan


When you’re investigating embezzlement, there’s no time to waste. If you don’t have a fraud response plan to guide your actions, develop one now. Having a plan in place from immediate corrective action to the reporting stage of the embezzlement investigation process means you can get started faster. A fraud response plan also reduces confusion and chaos and streamlines decision-making, which in turn eliminates stress for your team.


Need to draft on your plan right away? Download our free fraud response plan template to get started.

Ann Snook
Ann Snook

Marketing Writer

Ann is a marketing writer at i-Sight Software. She writes about issues related to investigations of fraud, employee misconduct, corporate security, Title IX, ethics & compliance and more.

Book A Demo

To our customers: We’ll never sell, distribute or reveal your email address to anyone. Privacy Policy

Want to conduct better investigations?

Sign up for i-Sight’s newsletter and get new articles, templates, CE eligible webinars and more delivered to your inbox every week.