When it is clear that the source of the losses within the company is internal and the basic measures did not rectify the situation, the employer will need to conduct an investigation in order to identify the responsible employee and gather evidence to support the allegations against them in a legal and admissible manner.
Whether the employer is investigating on their own or engages the services of a professional investigator, the following steps should be undertaken to make sure that the investigation unfolds in an effective manner and that the employer does not make any rash decisions and falsely accuses a wrong person of something they did not do which can open a door to potential legal problems for the employer.
LOOK FOR COMMON ELEMENTS
The first step during an internal investigation is to document the occurrences and analyze the circumstances surrounding the events in order to find common elements between them. Was the same employee present in all occurrences? Did losses only happen on Friday afternoons? Was a window open or was the door left unlocked? Did events develop or were discovered in a certain pattern? Those are only a few of endless other possible examples of leads that should be examined during an investigation.
It is to be noted that the lack of patterns or common elements is also a good lead in itself that may suggest that there are either multiple independent factors that are responsible for the losses, or that a single employee is deliberately trying to cover up their tracks, hide their actions or even shift the suspicion and the blame towards someone else.
FOLLOW THE LEADS
Once a lead is identified, it should be meticulously investigated. Starting with the most obvious and easy to prove or disprove, all elements of a lead (the what, where, when, why, how, who) should be examined and eliminated one by one until none are left or until only a few elements remain that will require a more in-depth inquiry (by getting additional information from an employee or finding supporting evidence to show their relevance, or the lack of, to the investigated event in question).
Evidence can be direct or circumstantial and can either be physical (ex: crowbar found by the door) or digital (ex: computer data log indicating file manipulation). Witnesses (ex: other employees or passersby) can also provide information that, if corroborated, can be used as evidence during the investigation.
Evidence can be gathered through examination of the premises and the surrounding areas, by conducting a detailed review of computer access and databases, by conducting a forensic review of accounting systems (which is often how major embezzlement and fraud schemes are discovered), and by conducting interviews with other employees or potential witnesses (ex: nearby store owners).
It is to be noted that gathering evidence is the most crucial step during the investigative process. If done right, it will provide the answers and the information needed to deal with the situation; however, if done wrong, not only it can lead the investigation in the wrong direction (ex: accuse the wrong person or implement improper and ineffective countermeasures), but it can also expose the employer to risk of litigation.
For this reason, it is imperative to know what type of evidence can and cannot be collected, how it can and cannot be gathered, what type of evidence can and cannot be used during the litigation process (should the employer want to undertake civil lawsuit later on or file criminal charges against the culprit), and how the evidence should be handled and preserved in order to make it admissible in court.
It is therefore critical for the person investigating the matter to be familiar with the laws and the regulations surrounding evidence acts, privacy laws, and other subjects related to workplace investigations (such as HR standards, labor laws, and employee rights).
CONFRONT THE SUSPECT
When all the investigative leads were explored and the supporting evidence was obtained, there should be little to no doubt as to which employee is responsible for the losses. This is the ideal scenario in which all that remains to be done is confront the employee during an interview, show them the facts and get their side of the story (and possibly an admission of guilt in the process).
Whether the employee denies the allegations (which is difficult if the employer has irrefutable evidence such as video footage that caught the employee in the act) or admits to the act, it won’t matter as much since the employer has already all the necessary information to take appropriate actions. Of course, it is always better to obtain an admission of guilt by the employee as it makes future administrative and legal actions much easier (if such admission was obtained in a legal manner).
Unfortunately, the ideal scenario is not always possible to achieve, and even after carefully examining all available leads, there may still be multiple potential suspects on the list. In such instances, the only possible way to obtain additional information is to conduct exploratory interviews with the suspected employees.
It is important to keep in mind that accusing someone without evidence or relying on weak or circumstantial evidence, can be dangerous for the employer from a legal perspective. For this reason, those interviews should be handled with extra caution in order to avoid accusing innocent employees or creating situations that could be interpreted as harassment.
Such exploratory interviews should only take place when no other possible leads are left to pursuit. If those interviews result in new information, the process of gathering and analyzing evidence in support of the new leads should be repeated until the investigation comes to a satisfactory conclusion or until no leads remain to be examined further.
REVIEW THE SITUATION
If, after gathering evidence and confronting the suspect, the investigation is successfully concluded and the culprit is identified and dealt with (either administratively or legally); it is important for the employer to look back at the situation and analyze all the elements that led up to the events in question.
To prevent the same occurrence from happening again, the employer needs to understand the circumstances that motivated the employee to behave in a certain way and to identify internal control measures (or the lack of) that facilitated such behavior or actions to go unnoticed until serious losses occurred.
Deficiencies in control protocols, ineffective physical security equipment, lack of administrative control and oversight, and ease of access, are some of the many factors that should be looked at when conducting a security audit, which is the recommended course of action after a company suffers losses.
Such audit will allow the decision-makers to identify weaknesses in their systems, and the security expert will be able to recommend efficient and cost-effective measures to be implemented in order to help the company limit any further opportunities for theft and fraud to occur in the future.
In the absence of a dedicated internal security team with trained staff to conduct a security audit or experienced investigators to take charge of the investigation; Private Investigators are the best resources to help employers find answers and the information they to make the right decisions for their company.
Experienced investigators know how to structure an investigation in the most effective way, thus saving the employer valuable time and money. They are also familiar with the legal aspects of the investigative process, which can ensure that all steps of the investigation will be executed in a legal and admissible manner that will not expose the employer to possible risk of litigation.
In most instances, Private Investigators will also be able to conduct security assessments and identify weaknesses within the company that could be exploited to commit theft and fraud. Due to their extensive knowledge of the subject matter, they will also be able to identify specific threats and vulnerabilities that will allow them to recommend business owners the best solutions to specific problems that the company may be facing.