Internal fraud: deciding well in the first 72 hours

A suspicion of internal fraud rarely arrives in a clean form. A supplier payment with no matching delivery, an invoice issued by a company incorporated three weeks earlier, an employee who insists on handling a client file alone: the signals vary, and the first reaction often determines the value of everything that follows.

The first seventy-two hours are not for concluding. They are for preventing three things: the destruction of evidence, the contamination of findings by undocumented conversations, and the launch of a process the company cannot sustain to the end.

Do not confront: preserve

The most common temptation is to interview the person under suspicion immediately. It occasionally produces an admission; more often it produces deleted traces and coordinated accounts. Before any conversation, access must be suspended: mailbox, ERP, shared drives, badge. That suspension is a technical and protective measure, to be documented, time-limited and justified by a serious ground.

It has a useful side effect: it freezes the state of the systems at an identifiable moment. It must never become a disguised sanction, nor be extended without a formal decision. An employee sidelined for weeks without a written reason already holds a strong argument, whatever the merits of the case.

Secure the evidence without contaminating it

Four operations shape the first hours.

• Forensic imaging of workstations and phones by a qualified provider, with hash values and a chain-of-custody log.
• Log extraction: connections, badge records, mail, ERP, changes to supplier and bank master data.
• Preservation of paper originals as they stand, without annotation or highlighting, envelopes and remittance slips included.
• Capture of exchanges with third parties, including the informal channels used for work.

Two technical rules prevent most later trouble. Do not open files on the seized machine: each opening alters metadata and invites a challenge to the integrity of the copy. And do not let the investigator become a witness: the person who observes and the person who analyses must be two different people, or the evidential value collapses at the first objection.

On communications, the employer’s hands are not free. Monitoring presupposes a policy known to staff, a serious ground and proportionate review; it cannot be used to explore private life. A system installed after the suspicion, with no written basis, weakens the file rather than strengthening it.

Two tracks, one file

Internal fraud opens two paths at once, disciplinary and criminal. They are not equivalent and do not substitute for one another. The internal path establishes facts, allows a proportionate sanction and keeps control of the timetable; it gives no access to bank accounts, searches or data held by third parties. The criminal path opens those means, but it largely removes the pace of proceedings from the company.

The order of operations matters more than their content. A dismissal pronounced too early can dry up the cooperation of a key witness and leave the perpetrator time to reorganise assets. A complaint filed too early can freeze an internal enquiry that is still incomplete. Waiting for certainty, conversely, usually means waiting too long.

Three parallel deadlines must be checked within the first week: notification periods under the crime insurance policy, reporting duties specific to regulated entities, and immediate technical steps — revocation of bank authorities, change of signatories, information to clients whose files are affected.

The rights of the employee under suspicion

These rights are not a procedural luxury; they condition the solidity of the outcome.

• An interview that is voluntary, described as such, with its purpose stated in writing.
• No threat, no promise of leniency, no detention against the person’s will.
• The possibility of being accompanied, and access to the facts alleged before any sanction.
• The presumption of innocence, including in internal communications.
• No polygraph, no psychological pressure, no public accusation.

An interview obtained under constraint makes the sanction contestable and exposes the company itself: coercion, infringement of personality rights, deprivation of liberty. A clean process always costs less than an annulled one, and the gap widens once the matter becomes public.

Govern the communication

A single spokesperson, a strictly factual account, no speculation by internal email. Sensitive exchanges should be conducted under the direction of external counsel, the confidentiality attaching to in-house lawyers being limited in Switzerland. The board or its audit committee should be informed early, on facts rather than hypotheses, and the delegation of decision-making should be in writing.

Discretion here is not secrecy. It is the condition for establishing facts before characterising them, and for hearing the person concerned before judging them.

If you face an anomaly you cannot yet characterise, an initial confidential consultation will fix the sequence of measures, secure what can still be secured and identify the appropriate track. It commits you to nothing. These pages are editorial information and do not constitute legal advice.