When Fraud Comes from Within: Intervening Quickly, Calmly, and Methodically

We’re (Almost) Always Called Too Late

“In general, we’re called once it has already happened, not for prevention,” explains Denis Hamel. The alert often comes from a bank flagging a suspicious transfer to a company linked to an employee, or from something mundane, such as an absence or a replacement that brings irregularities to light. “The first step is to go into emergency mode: contact a lawyer, a forensic accountant, then cut off banking and IT access, suspend the employee if necessary, and secure the information.” This protocol is designed to prevent further damage and preserve evidence before digging deeper.

Very “Analog” Frauds

Contrary to popular belief, most cases are surprisingly basic: forged cheques, imitated signatures, fake suppliers, inflated expense claims. “High-tech frauds make headlines, but most of what we see is still very human and very paper-based,” says Hamel. Even banking features can be exploited. “We’ve seen paycheques from 2018 redeposited in 2020 or 2021 using mobile deposit, without triggering an alert. The banking fraud detection systems are built for processing volume, not catching every anomaly.”

The Goal: Stop the Bleeding and Recover Funds

In most cases, the immediate objective is to stop the situation, quantify the losses, and recover funds — not necessarily to go to the police. “Taking it to court makes the case public, and for some organizations, the reputational damage can cost more than the fraud itself,” notes Hamel. When cases do proceed to criminal prosecution, “the forensic accounting report serves as the foundation for the police investigation.”

"By treating individuals respectfully, we often obtain fuller admissions, sometimes beyond what we had already documented", Hamel explains

Internal Audit, HR, Forensic Accounting: Who Does What

Each player has a distinct role. “Internal audit ensures controls are in place and that dollars are being spent appropriately. Actively searching for fraud isn’t their main mandate,” Hamel explains. HR teams and workplace investigators intervene mostly in cases of harassment or misconduct and “call us when corruption or misappropriation comes up.” The forensic accountant, meanwhile, “quantifies the losses, documents the mechanisms, and builds a strong case that can support termination for cause, a financial recovery, or even litigation.” An external perspective, he adds, “adds credibility when management or the board needs to make tough decisions.”

Governance: Where It All Starts — and Breaks Down

Abuse of expense accounts is common in public or non-profit organizations, especially where rules are vague. “Without clear policies on gifts, travel classes, or meals, what starts as tolerated quickly becomes the norm and then outright abuse. Without written, enforced rules, the elastic always stretches until it snaps,” warns Hamel. The private sector is not immune: overly compliant boards, weak segregation of duties, and poorly controlled banking authority all create vulnerabilities. “Vigilance has to be constant. Old habits resurface quickly.”

How to Quantify a Fraud

Sampling is not enough. “We look at everything. If we suspect fraud, there’s no materiality threshold: we want to know down to the penny how many cheques were cashed and how many transfers were made, and we attach every piece of evidence to the report,” Hamel explains. This rigour supports both negotiated exits and potential criminal charges.

Who We Work With and When to Call

“In 95% of cases, the mandate comes from lawyers, litigation, employment, or family law,” says Hamel. Forensic accountants also intervene in divorce cases and shareholder disputes. The best time to call? “As soon as doubt arises. A vulnerability assessment can close doors before an incident occurs, and it always costs less than managing a full-blown crisis.”

"In 95% of cases, the mandate comes from lawyers, litigation, employment, or family law," says Hamel.

Common Mistakes to Avoid

One classic mistake is trying to handle the situation internally. “Evidence gets lost, recovery opportunities disappear, and confronting the employee directly either shuts them down or prompts them to cover their tracks,” warns Hamel. Other errors include delaying access shutdowns and failing to notify insurers. “Many policies cover professional investigation fees, but only if you inform the insurer right away.”

The Method That Works: A Tight Team

The winning formula combines management or the board for leadership, lawyers for the legal framework, and forensic accountants for quantification and evidence. “With the right support, we move forward step by step with regular updates. We know when to push and when to stop.”

A Firm but Human Approach

Even when meeting with the alleged wrongdoer, the approach is not intimidating. “I’m not there to scare people, but to establish the facts. By treating individuals respectfully, we often obtain fuller admissions, sometimes beyond what we had already documented,” Hamel explains. This professional but human approach doesn’t excuse misconduct. Rather, “it accelerates the truth, the negotiation, and, if needed, the legal process.”

10 Crisis-Response Reflexes Every CFO Should Post on the Wall

1. Immediately cut off all access (banking, ERP, cards)
2. Suspend the individual and secure information
3.  Notify the insurer (verify coverage for investigation fees)
4. Freeze systems (emails, logs, backups)
5. Centralize communications (single spokesperson)
6. Never confront the suspect alone; involve lawyers and forensic accountants
7. Document everything down to the penny (transactions, evidence, chain of custody)
8. Review banking authorities and segregation of duties
9. Clarify policies on expenses, gifts, travel, and enforce them
10. Plan for the aftermath: recovery, disciplinary measures, prevention

_{Note: Some examples have been anonymized and adapted to protect the confidentiality of case}