If your business has been a victim of fraud, it’s natural to do all you can – as fast as you can – to repair the damage and get back to work. But, before you do that, it’s vital to preserve the evidence so that nothing is inadvertently destroyed or discarded. Losing critical data related to the fraudulent activity means lessening your chances of bringing the perpetrators to justice.
Place any physical evidence you find in a safe location that’s accessible only to a few key people. Don’t make notes on any paper documents and, unless necessary, don’t let them be handled. Instead, make separate notations about when and where they were found and how you preserved them. A court case can be derailed if you don’t preserve the chain of evidence.
Handling paper documents is relatively easy as long as you approach the task with care. Copy anything you need to continue operations, and then turn the originals over to fraud examiners or law enforcement for fingerprinting, handwriting analysis or other forensic testing.
Computers are another story, especially if your IT staff isn’t trained to deal with fraud evidence.
Even the most skilled IT technician may unintentionally alter or destroy evidence in the course of restoring computer systems or devices to normal operations.
To avoid such mishaps, any routine data destruction should be put on hold. If your system automatically deletes certain information (including emails) periodically, that process must be discontinued immediately. IT staff should keep their investigative activities to a minimum while they act promptly to ensure that no further alterations can be made to existing files.
Your business then needs to hand the matter over to a computer forensics specialist. This expert can identify and restore altered records, digital forgeries and files that have been intentionally corrupted. They also can get to secured or password-protected files and pinpoint unauthorized system access — all without destroying or damaging suspect files.
Successful fraud investigations live or die on the amount and integrity of the evidence that‘s uncovered. Preparing to respond in a manner that preserves fraud evidence is the first step in the process of catching and punishing a thief.
If you have questions about preserving evidence of fraud or need other forensic accounting assistance, JLK Rosenberger can help. For more information, call us at 949-860-9902 or click here to contact us.