Recovering from fraud: strategies for resilience and transformation

Beyond the financial impact, fraud often exposes weaknesses in governance, culture and operational resilience. For leadership teams, the challenge is not only to recover assets but to restore trust, stabilise operations and strengthen the organisation against future risks. This requires a comprehensive approach that goes beyond investigation to embed lasting improvements.

“Recovery and prevention are inseparable. The forensic insights that reveal what happened become the foundation for ensuring it cannot happen again.”

Chris Drewe Partner - Crisis & Disputes

Responding to crises beyond fraud

Fraud is rarely an isolated event. It often signals surfaces unforeseen vulnerabilities that can escalate into wider crises, such as governance breakdowns, operational disruption or cultural dysfunction. Addressing these challenges requires more than forensic expertise; it calls for rapid mobilisation and coordinated action across multiple disciplines.

At Forvis Mazars, our experience shows that organisations benefit most when they treat fraud recovery as part of a broader resilience strategy. This means stabilising operations quickly, restoring stakeholder confidence and embedding lessons learned into long-term governance and risk frameworks.

"In critical situations, speed and clarity are paramount. The ability to mobilise the right expertise at the right time can make the difference between containment and escalation."

– Stéphane Ziolo, Partner, Forvis Mazars in France

Recovery from fraud requires more than just a good investigation and a successful remediation. Especially for sensitive internal investigations, effective recovery requires careful stakeholder management, intentional workforce relations and a follow-up focused on prevention.

Complexity vs sensitivity in fraud cases

Whilst external fraud – especially the likes of what often targets large banks or other financial institutions – can be complex to investigate, complexity isn’t the only matrix for measuring impact. Sensitivity can also add challenge, and internal fraud or collusion between internal and external parties are often far more sensitive to address.

According to the ACFE Report to the Nations 2024, upper management accounts for 9% of surveyed fraud cases, whilst operations represents 14%; but upper management fraud yields the highest median losses. 68% of cases result in termination of employment or services, yet only 49% of organisations successfully recover their assets.

“Investigations work on sliding scales of both complexity and sensitivity, and the recovery strategy often adapts according to where an incident sits on each of those axes.”

Keeran Madhav Director - Forensic Services

This intersection of sensitivity and complexity is why forensic investigations into internal fraud or collusion are often handed over to trusted third parties; true independence is critical, especially in sensitive scenarios, so that the whole organisation may be thoroughly investigated without fear of backlash.

The human dimension of recovery

Fraud investigations inevitably involve people: witnesses, potential perpetrators, victims and stakeholders. Managing these human dimensions requires sensitivity, legal awareness and clear communication. This is particularly true for internal fraud, where businesses must balance investigative needs with employment law, personal privacy, and maintaining workplace morale.

Cultural context matters significantly as well; not just geopolitically, either, but the culture of the specific company. Whilst regulation in places like France protects whistleblowers, cultural attitudes toward reporting can discourage people from coming forward. Organisations recovering from fraud must address these cultural barriers, creating environments where employees feel safe reporting concerns without fear of retaliation. And when investigations are underway, the teams conducting them must work together with leadership to inspire transparency and collaboration.

Pre-investigation: how our experts optimise the investigation before they start

When Forvis Mazars’ forensic teams investigate instances of fraud, they take three key steps before any forensic work begins that prove paramount to optimise results:

1. Identify & engage key stakeholders early – this can and should include regulators, investors, counterparties, vendors and at times even customers
2. Quarantine management and key parties, keeping in mind process management and personal relationships that may not be reflected on an org chart
3. Involve crisis communications experts/teams in the process, keeping relevant stakeholders (investors, the workforce, etc.) informed and feeling confident that all is in hand

Once this pre-investigation groundwork is complete, then forensic accountants and technologists can investigate properly without running into conflicts, and the team can keep stakeholders appropriately informed.

“The main reason organisations outsource investigations is for independence. It’s almost impossible for an internal team to truly achieve independence, especially for internal incidents, so having a trusted partner investigating is a much more balanced approach.”

– Erik Lioy, Partner, Forvis Mazars US

Asset tracing and preservation as a priority

When fraud is identified, immediate action to preserve assets becomes critical. This might involve preservation orders or, in cases involving tax evasion, specialised orders that coordinate with tax authorities. However, managing potential conflicts between different recovery mechanisms requires careful navigation; forensic experts, tax specialists and legal teams must work together to optimise recovery strategies.

Asset tracing follows the money through increasingly complex chains. Fraudsters don't simply pocket funds; they layer transactions, move money across jurisdictions and attempt to obscure the trail. Forensic accountants bring specialised skills to this pursuit, reconstructing financial flows and identifying recoverable assets, whilst global firms like Forvis Mazars have varied geographical and political expertise in-house to navigate the added complexity international investigations may pose. Each jurisdiction presents distinct legal frameworks for asset recovery, and successful tracing often requires coordination with local authorities and international law enforcement.

Post-investigation: support all the way to recovery (and beyond)

Once the forensic work is complete and the findings have been gathered, our teams then present and file those findings as appropriate with management, stakeholders and regulators when needed. They then are able to support the organisation with whatever the appropriate next step(s) may be:

1. Insurance claims – successfully claiming requires thorough documentation of losses and circumstances, and forensic teams are experienced in articulating the incident in an actionable way.
2. Litigation or arbitration support – forensic experts are often crucial in proceedings (preparing exhibits, testifying as expert witnesses, etc.), and their involvement can mean the difference between successful and unsuccessful recovery efforts.
3. Self-disclosure – when the company is found to have engaged in fraudulent practices, perhaps through rogue divisions or executives acting without board knowledge, recovery may require taking the company to the authorities for self-disclosure; forensic teams can help the organisation navigate the details and implications of this.

The prevention-recovery cycle

Lessons learned from fraud recovery can naturally be applied to help strengthen fraud prevention strategies in the future. Once the appropriate actions have been taken, the next step is to look at how to shore up defences. This could include:

●     Consulting on operational, organisational or financial improvements

●     New policies and procedures, and associated communications strategies

●     Red teaming exercises to identify additional weak points

●     Workforce education and enablement

“The entire organisation needs to be fraud aware and risk aware, and nothing puts that into perspective better than an incident. Policy improvements and education are two of the most important measures you can put in place to both discourage fraud itself and encourage reporting.”

Caroline Leblanc

Whilst these steps can be taken during an ongoing investigation, and all organisations should be regularly reviewing and improving their fraud prevention measures, they should happen separately from the investigation so that findings are not coloured by these initiatives.

With greater fraud prevention measures comes greater resilience and greater recovery odds should something happen again in the future. This prevention-recovery cycle, whilst hopefully one that doesn’t repeat often, should be used as an opportunity for growth and awareness.

Whilst asset recovery matters financially, comprehensive recovery success encompasses broader metrics. Have controls improved measurably? Has reporting culture strengthened? Are detection capabilities more sophisticated? Can the organisation demonstrate to regulators, investors and stakeholders that it has addressed root causes? Organisations that answer these questions affirmatively emerge from fraud incidents stronger than before.

Turning recovery into resilience

The statistics about asset recovery rates prove sobering, but they needn't be deterministic. Organisations that approach recovery comprehensively, that understand its multi-dimensional nature, and that leverage trusted expertise recover more successfully – both financially and organisationally.

Moreover, these organisations recognise that recovery is never truly complete. Fraudsters evolve, technologies advance, and new vulnerabilities emerge. The vigilance, capabilities and culture developed during recovery become ongoing organisational assets, continuously refined and strengthened. In this sense, comprehensive recovery doesn't end with case closure; it initiates a permanent organisational transformation toward fraud resilience. 

Contact us