11.2 Fraud Investigation Role & Techniques

Detecting red flags is only half the battle. Syllabus topic D5 focuses on the internal audit function's role in fraud investigations, the techniques used to gather evidence, and how auditors coordinate with specialists. A recurring exam theme: internal auditors are not automatically forensic investigators—role clarity protects objectivity, legal defensibility, and investigation quality.

Internal Audit's Role in Fraud Investigations

Under the Global Internal Audit Standards and common practice, the internal audit (IA) activity:

• Helps the organization assess fraud risk and evaluate anti-fraud controls
• Remains alert to fraud indicators during assurance and advisory engagements
• May perform preliminary assessments when suspicions arise
• Supports management and the board by gathering facts, preserving evidence, and documenting findings
• Coordinates with legal counsel, compliance, HR, external auditors, and law enforcement as appropriate

Critically, IA typically supports and coordinates; forensic specialists or designated fraud investigators lead complex investigations. Reasons include:

The internal audit charter and investigation protocols should define when IA leads versus supports, escalation paths to the audit committee, and how findings are reported. If management asks IA to "quietly handle" a sensitive allegation without informing the board or audit committee when policy requires disclosure, that request itself is a governance red flag.

Exam clarity statement: Do not assume IA always owns the full investigation end-to-end. The default exam-correct framing is that IA assists, coordinates, and may perform limited procedures, while complex or high-stakes cases are led by forensic specialists.

Preparing for Investigation Work: Review Before You Dig

Before launching procedures, auditors should review available intelligence so testing is risk-focused rather than random:

1. Fraud risk assessments — Identify high-risk processes, locations, and schemes already mapped by management or IA
2. Prior investigations — Learn recurring schemes, control failures, and whether remediation actually stuck
3. Trends and analytics — Rising write-offs, margin erosion, vendor concentration, or overtime spikes may frame hypotheses
4. Whistleblower complaints — Tips often provide the most direct leads; assess credibility, specificity, and related cases

This review helps define scope, preserve relevant records, and avoid tipping off suspects prematurely. It also supports due professional care: diving into interviews without understanding process flows and prior findings wastes time and can damage the case.

Interviewing Techniques

Interviews are central to most fraud investigations. Effective interviewing is a skill—and poor technique can produce unreliable statements or legal problems.

Planning the Interview

• Clarify the interview's purpose (information gathering vs. admission-seeking)
• Review documents and timelines before sitting down
• Decide order of interviewees (often start with less involved parties; interview the suspected perpetrator later)
• Arrange a private setting and, when appropriate, a second interviewer or witness
• Coordinate with legal counsel on rights, recording, and union or employment-law constraints

Conducting the Interview

Strong technique emphasizes:

Avoid leading questions that put the answer in the interviewee's mouth ("You altered the invoice, didn't you?") until you have a deliberate admission-seeking strategy and appropriate authority. Do not promise confidentiality you cannot keep, and do not offer immunity—that is typically a legal/management decision.

Example: Instead of asking "Did you steal the cash?", an information-gathering interview might ask: "Walk me through how end-of-day cash is counted, recorded, and deposited. Who else is involved, and what happens when amounts do not match?"

Investigation Techniques Beyond Interviews

Fraud investigations combine multiple evidence sources:

• Document examination — Invoices, contracts, emails, approval logs, shipping records, and journal entries
• Physical observation — Surprise cash counts, inventory observations, or process walkthroughs
• Data analytics / CAATTs — Duplicate payments, round-dollar transactions, weekend postings, vendor–employee address matches
• Third-party confirmation — Vendor, customer, or bank confirmations to corroborate internal records
• Digital forensics — Imaging devices, recovering deleted files (usually specialist-led)
• Background and public-record checks — Conflicts of interest, related-party entities, lifestyle indicators (within legal limits)

Evidence should be relevant, sufficient, and reliable. Maintain chain of custody for original documents and electronic media. Working papers should show the source of each fact, how it was tested, and how it supports (or refutes) the allegation.

Fraud Testing Methods

Internal auditors use fraud-oriented testing both during routine engagements and in investigation support:

Fraud testing differs from ordinary control testing in mindset: assume that a motivated perpetrator may try to conceal activity. Look for overrides, collusion indicators, and "too perfect" documentation. Collusion can defeat SoD, so do not stop at confirming that two signatures exist—evaluate whether the approvers actually reviewed substance.

Coordinating with Fraud Investigators and Other Parties

Coordination protects the investigation and the organization:

• Agree on roles — Who leads interviews, who holds evidence, who speaks to external parties
• Preserve privilege where legal counsel directs work product appropriately
• Align on communication — Avoid inconsistent statements to employees, regulators, or the press
• Share findings carefully — Need-to-know distribution; update the audit committee per protocol
• Plan remediation — Control fixes, recovery actions, employment decisions, and referral to authorities

Internal auditors should not publicly accuse individuals, destroy or alter evidence, or expand scope into areas outside competence without help. If IA discovers potential criminal conduct, escalation through the defined governance channel is required.

Putting It Together: A Practical Flow

A typical support path looks like this:

1. Receive tip or identify red flag
2. Review risk assessments, prior cases, trends, and related complaints
3. Secure and preserve relevant data
4. Coordinate with management, counsel, and investigators on mandate and roles
5. Perform interviews and fraud tests within agreed scope
6. Document findings objectively
7. Hand off complex forensic work to specialists as needed
8. Report to appropriate governance bodies and monitor remediation

This sequence reinforces the exam message: IA is a critical partner in fraud response, but effectiveness depends on preparation, technique, coordination, and knowing when specialists must lead.

Key Takeaways for the Exam

• IA usually supports/coordinates; forensic specialists lead complex investigations
• Review risk assessments, prior investigations, trends, and whistleblower complaints before deep testing
• Interview with planning, open-ended questions, listening, and careful documentation
• Combine documents, analytics, observation, and corroboration
• Use targeted fraud testing methods and coordinate clearly with investigators and counsel