Conducting Dishonest Employee Investigations

When companies believe they have been taken advantage of by a potentially dishonest employee, many have no idea what to do next. Many times business owners or managers jump directly to what is perceived as being the easy solution; the employee in question is terminated. However, is that really the best action to take? Many forensic accountants and corporate investigators will say it is not.

The first thing the company needs do is verify that the employee in question is in fact dishonest. There are very few matters that can cause more unhappiness in a workplace, or amongst a workforce, than an employer targeting an employee that has done nothing wrong.

Companies often forget to determine if “predication” is present before any type of investigation begins or accusations of wrong doings are made. Predication is defined as being a set of circumstances that would lead a reasonable and professionally-trained person to believe that fraud has occurred, is occurring, or will occur in the future

Predication can be found to be present with the help of things such as tips, accounting anomalies, surveillance, etc. A fraud investigation should never be conducted without predication being present. In reality, the accused employee may have upset someone enough that false accusations are made to “get even” or to cause the employee suffering. The following are some of the questions the company’s management or company investigator can ask themselves and others before any accusations are made or an investigation begins:

  • Did someone tell you the employee was dishonest?
  • Is there evidence the employee is being dishonest?
  • If evidence is present, is the evidence being safe-guarded?
  • When and how should you talk with the employee?
  • If the employee is coming back from a Workers Compensation Claim, how should the interview be conducted?
  • Is the employee a female and does she happen to be pregnant?
  • If the employee is a female, should a male investigator interview her alone?
  • If a witness is to be involved in the interview, should the witness be male or female?
  • Is the employee under 18 years of age? If so, does one of their parents need to be present during the interview?
  • Are there any cultural issues that need to be taken into account before interviewing the individual?
  • Will the “opportunity” the employee took advantage of still exist after the employee in question is terminated, suspended, reassigned or resigns?
  • How do I keep this from happening again?
  • Will the matter be handled internally, through a civil proceeding, or in a criminal court?
  • If the matter is to be handled in a criminal court, when do the police need to be involved in the investigation?
  • Is the matter in question covered under the company’s insurance coverage and if so, what documentation or procedures need to be followed in order to file a timely claim?

Once predication is determined, it is best if the owners or managers bring in outside experts to assist with the investigation. Many fraud investigations handled “in-house” are not done correctly for many different reasons. Some of which are accusing or alerting the individual suspected of the fraud at the wrong time, mishandling evidence, assumptions of involvement, failure to obtain a verbal or written statement of involvement from the suspect(s) and/or personal emotions getting involved.

In fact, emotions may be the hardest aspect for the management to get over or deal with. The owners and/or managers may feel embarrassed that someone was allowed to steal from the company. They may feel they “should have known better” and if they had only done something differently, this matter would never have taken place.

Business owners and managers must work to move past the feeling of being embarrassed. Trusting their employees is not the reason they were taken advantage of or stolen from. People take advantage of situations for many different reasons. Some reasons make sense and actually seem like they may be justified but most make no sense at all.

People who steal from those who have entrusted them with the well-being of their company must be held accountable for their actions. If not, you are allowing this person to go somewhere else and potentially victimize another organization or individual. I would believe the majority of business owners and/or managers don’t wish to feel as if they could have done something to prevent another business and/or individual from suffering the same fate as they have. Hold dishonest employees accountable for their actions.

If something does not seem right in your business, contact your attorney, your banker, your local law enforcement agency, or a forensic accountant for expert assistance in determining if something dishonest took place. Make sure your internal controls work properly in order to avoid potential fraud and catastrophe. Remember: prevention is always cheaper than detection.

Use of investigative accounting to carve out financial exploitation


According to the National Adult Protective Services Association (NAPSA), financial exploitation is one of the fastest growing forms of abuse against vulnerable adults. As the population of the United States continues to age, it is an unfortunate reality that the attempts to exploit vulnerable adults will only rise. A conservator and/or guardian can prevent financial exploitation by closely managing the vulnerable adult’s accounts and how the accounts are accessed. If financial exploitation is suspected, a meticulous review of financial records will be necessary. Depending upon the complexity and volume of financial documents, the services of a forensic accountant should be considered.


Forensic accounting is actions taken in order to attempt to piece together or reconstruct a past event, or events, using financial information. In the context of vulnerable adults, forensic accounting is focused on following the money, and identifying cases of misuse of assets owned by the vulnerable adult. This process is done using bank records, credit card statements, tax returns, public records and other information obtained throughout the engagement.

Investigations typically begin with the examination of bank and investment account records, tax returns, loan files and credit card account statements. Through an examination of these records, forensic accountants will likely be able to identify all accounts held by the vulnerable adult. Examining these records will also allow the forensic accountants to determine if there are any expenses not associated with the vulnerable adult or if there is any missing income.

These misuses can be identified and documented using unique forensic investigative software and advanced spreadsheet tactics, such as pivot tables, charts, and graphs. After the investigation, work papers and/or a narrative report is published by the forensic accountants. The work product created by forensic accountants will provide you and legal authorities with the information they need to draw conclusions regarding whether or not financial exploitation has taken place.

Exploitation Case 101[1]

“Mrs. Ethel Crane” is an eight-one year old individual suffering from dementia. She has been in a relationship with fifty-eight year old “Mr. Smith” for the past few years. Mr. Smith is a construction worker in the area and visits Ethel on occasion. Taking advantage of his relationship with Ethel, and her vulnerability, Mr. Smith begins exploiting Ethel’s finances and using them for his own gain.

Dating back to the year prior to the beginning of Ethel and Mr. Smith’s relationship, over 4,250 financial transactions were examined. These transactions consisted of everything from checks and check card purchases to deposits and transfers. It was discovered that after gaining access to Ethel’s financial accounts, Mr. Smith began to use the money to support a lifestyle beyond his means. Mr. Smith used Ethel’s money to make payments on vehicle loans, including a snowmobile, and an ATV he bought after gaining access to Ethel’s funds. In addition to making payments on multiple vehicles, Mr. Smith took cash advances against Ethel’s account and used her assets to cover monthly bills for telecommunications, utilities, and insurance.

[1] Names have been changed to protect identities

In the year prior to the beginning of Ethel and Mr. Smith’s relationship, Ethel disbursed approximately $52,600 from her accounts. During the four years between the beginning of their relationship and the investigation of financial exploitation, Ethel’s accounts disbursed more than $410,000; three of the four years, amounts disbursed were more than double what Ethel was spending before the relationship began. In the third and fourth years in question, nearly half of the disbursements were flagged as suspicious. After the investigation was complete, it was determined that Mr. Smith had exploited Ethel of more than $199,000.


Due to the trusting nature created by the abuser and the nature of certain financial transactions, it can be difficult to identify financial exploitation. If it is suspected that financial exploitation of a vulnerable adult is taking place, there are a few steps that can be taken to ease the suspicions and help confirm them. Although you may be able to identify financial exploitation without having access to the vulnerable adult’s financial records, it is practically impossible to verify and document the totality of financial exploitation without examining financial records. Using financial records, no matter how voluminous they may be, will shed light on patterns of financial exploitation if it has been occurring.

One of the simplest actions to take when attempting to uncover exploitation is examining the purchases from the vulnerable adult’s accounts. For most vulnerable adults, spending is fairly consistent. One indication of possible exploitation is an increasing pattern of disbursements from financial accounts. This increase may be caused by multiple individuals using the assets, no longer just the vulnerable adult. Examining individual transactions rather than the sum of spending within the accounts will provide additional details on the nature of the transactions. For example, you may come across a purchase of rock concert tickets or gas purchases although the vulnerable adult has not driven in several years.

When examining financial records over a period of time, you will gain sense for the types of transactions made by the vulnerable adult on a monthly basis. This is especially true when examining transactions before the alleged exploitation began. This develops a baseline for the vulnerable adult’s “typical” spending habits. The transactions that do not appear to fit the baseline pattern when examining financial records during the period of potential exploitation, may be the exploitation items in question. Further investigating these items and other transactions will assist you in uncovering potential financial exploitation.


Conservators and/or guardians most likely do not specialize in forensic accounting nor might they get excited about spending hours documenting questionable financial transactions through the use of pivot tables and investigative software. Generally speaking, adult protection service workers, police and prosecutors do not specialize in forensic accounting either. The good news is that forensic accountants have the experience needed to document exploitation matters for the court of law. Forensic accountants are available to help during any step of the exploitation investigation process. Depending upon the complexity of the matter, the services provided by forensic accountants may range from consultation on how to locate financial records to assisting with the examination of financial records to creating a comprehensive forensic report for prosecution purposes.