When a routine internal audit of your area turns into a fraud investigation, three things change at once: who is running it (counsel, a forensic team and HR, not only the auditors you met at kickoff), what they want from you (preserved records and discretion, more than explanations), and what you are (a witness and a custodian of evidence, sometimes the manager of the person under suspicion, and only rarely a subject yourself). The right conduct follows from that. Cooperate fully. Preserve everything in your area exactly as it is. Stop any inquiry of your own. Tell nobody who does not need to know. Do not confront, warn, question or quietly sideline the person you think is involved. Keep a dated log of what you are asked and what you do. And put a short list of questions to the investigation lead, set out below, so that you act on instructions rather than guesses.
Nobody will announce the change. Auditors who reach what fraud examiners call predication, a reasonable basis to believe fraud may have occurred, are trained to stop auditing, preserve what they have, escalate to the chief audit executive and general counsel, and specifically not to tell the line manager; that protocol is written from the auditor’s side in the first 48 hours guide. This guide is the other chair, and it sits in the Being Audited? hub. The stakes are real. In the ACFE’s Occupational Fraud 2026: A Report to the Nations, published in May 2026 from 2,402 investigated cases, the median scheme ran 12 months before detection and the median loss was $104,000; schemes caught within six months had a median loss of $40,000, and schemes that ran more than five years a median above $1.1 million. The manager who handles the next few weeks well shortens the scheme and protects the evidence. The one who handles them badly can turn a recoverable loss into an unrecoverable one.
In this guide
- How to tell that the audit has become an investigation
- What changes procedurally, and who runs it now
- What you must do
- What you must not do
- The manager’s preservation checklist
- Your own position: witness, manager of the subject, subject or reporter
- If you are interviewed
- Keeping the business running while access is restricted
- Questions to ask the investigation lead
- What happens after
- Worked example: Calder Building Products
- The longer lesson: red flags you can watch for
- Questions readers ask
- Related guides
How to tell that the audit has become an investigation
In a routine audit the team is trying to understand your process and test whether its controls work; the auditors tell you what they are finding, and the closing meeting is on the calendar from day one. In an investigation the questions are about specific transactions, dates, people and approvals; the people asking include lawyers; the requests are about preserving rather than explaining; and the auditors stop telling you what they think. The Standards push them this way: Standard 4.2 (Due Professional Care) requires auditors to consider the probability of significant errors, fraud and noncompliance, Standard 4.3 (Professional Skepticism) requires them to seek more evidence when information looks incomplete, inconsistent or misleading, Standard 1.1 (Honesty and Professional Courage) forbids concealing or omitting findings, and Standard 5.2 (Protection of Information) forbids disclosing confidential information to anyone not authorized to have it. The IIA’s position, restated in its April 2026 white paper with the Anti-Fraud Collaboration, is that “The internal auditor should not be expected to have the expertise of a person whose primary responsibility is to investigate fraud.” That is why, at the moment of predication, the matter usually leaves the audit team’s sole control and the faces you see change.
| Signal | What it usually means | What it does not mean |
|---|---|---|
| Questions shift to named transactions, dates, approvers, amounts | A sequence of events is being reconstructed | Proof of fraud; auditors do this for ordinary exceptions too |
| A preservation or legal hold notice | Counsel is involved and considers a legal or regulatory matter possible | An accusation; managers are custodians, and holds go to custodians |
| New faces: general counsel’s office, HR, security, forensic accountants | The matter has left internal audit’s sole control | That the audit “failed” |
| Requests go to IT, not to you: mailbox exports, logs, badge data | Evidence is being preserved without alerting anyone, including you | A breach of your authority |
| Someone’s access suspended “for maintenance,” or leave “pending a review” | Containment; HR and counsel decided their status | Guilt; suspension is usually a neutral holding step, often on full pay |
| Preliminary findings dry up; the closing meeting slips with no new date | The finding function has been separated from the investigation | Rudeness; the auditors are now fact witnesses |
| An unannounced interview, two people, one writing, opening with whom the lawyer represents | An investigation interview under privilege (the “Upjohn” opening, below) | An employment hearing, or that you are a subject |
One look-alike: when testing throws up exceptions, auditors expand samples and ask many more transaction-level questions, which is ordinary fieldwork, explained in the guide to handling test exceptions. The differences are that nobody from legal appears, no hold is issued, and the team keeps discussing what it finds with you. Practitioner judgment: if two or more of the first five signals coincide, assume an investigation. There is no cost to behaving as if it were one when it is not. The reverse can cost the organization the case.
What changes procedurally, and who runs it now
The first change is a split. The auditor who found the indicator becomes a fact witness, and the decision about what happens next moves to the chief audit executive and the general counsel. In most organizations of any size, counsel then directs the investigation so that the work can be protected by legal privilege, using whichever hands fit the matter: internal audit’s own investigators, a forensic accounting firm, corporate security, HR, and in regulated firms the compliance or financial-crime function. In smaller organizations internal audit may do the fieldwork itself, still under counsel’s direction. Either way, the people who decide your instructions are no longer the audit team, and the audit team may be unable to answer your questions even when they want to.
The second change is in authority. Internal audit already has, under its board-approved charter, unrestricted access to the data, records, information, people and physical property it needs; Standard 6.3 (Board and Senior Management Support) is where the Standards place that expectation on the board and senior management, and the practical limits are in the guide to what internal audit can and cannot do. An investigation adds counsel’s authority over privilege and preservation and HR’s over employment status. It does not add police powers: nobody inside the organization can compel you to answer the way a court can, search your personal property or detain you. What employment policies commonly do allow is to treat a refusal to cooperate, or the destruction of records, as a disciplinary matter in itself. The third change is confidentiality, which cuts both ways: you will be told less than you expect, and that protects you as much as the process.
| Role | Typically decides | Does not decide | What you will see |
|---|---|---|---|
| Audit team that found it | Whether there is a basis to refer | Employment outcomes; whether a crime occurred | Narrower questions, then a hand-off and silence |
| Chief audit executive | Referral; whether audit investigates, supports or stands back; informing the audit committee chair | Discipline; legal strategy | Possibly a first call explaining who will contact you |
| General counsel or outside counsel | Direction; privilege; preservation; notices to regulators, insurers, law enforcement | How you run the business | Hold notices; interview framing; what you may say |
| Forensic accountants or investigators | Evidence to collect; quantification; interview order | Outcomes for anyone | Data requests through counsel; interviews |
| Human resources | Suspension; fairness steps; communications to the person | What the facts are | Leave arrangements; your team script; non-retaliation reminders |
| IT and security | How preservation is done; access changes | Who is investigated | Access changes without explanation; device requests |
| Your executive | Continuity; temporary delegations; your availability | The investigation’s scope | Cover arrangements; often no more information than you have |
Expect your access to be touched: roles narrowed, approvals re-routed, drives made read-only, a cash office sealed, a vendor master frozen. None of it is a comment on you; it is the cheapest way to make sure nothing changes while facts are established. The routine audit itself will pause, continue with a narrower scope, or complete with the control weakness written up and the individual left out. The auditor’s rule for that last case, “report the control, not the person,” is why the report you eventually receive may describe a failed approval control without mentioning who exploited it.
What you must do
Everything on this list protects the evidence, the fairness of the process, or you. Cooperation and preservation come first because they are irreversible if missed; the log comes early because it is cheap now and expensive to reconstruct later.
| Action | Why it matters | How to do it well |
|---|---|---|
| Cooperate, fully and promptly | Policies commonly require it; refusal can become its own disciplinary matter | Answer what is asked; bring the records; say “I don’t know” when true |
| Preserve everything as it is | In many jurisdictions a duty to preserve arises once a legal matter is reasonably anticipated; lost records can count against the organization even when nobody meant to lose them | Stop clean-ups and reorganizations; lock paper where it sits; use the checklist below |
| Stop any inquiry of your own | Tips people off, puts your name in access logs beside the subject’s files, contaminates witnesses | If you have started, stop, write down what you looked at, tell the lead |
| Limit who you tell | Rumor harms an innocent person and a live case; identifying a reporter can itself be retaliation | The lead and, if instructed, your executive; nobody else |
| Keep a dated personal log | You will be asked months later what you were told, when, and what you did | Requests, what you provided, decisions and approvers; facts, no theories |
| Run approvals by the book, through one channel | Every decision in this period may be examined; parallel conversations produce inconsistent instructions | No verbal sign-offs; a single point of contact; interim procedures in writing |
| Treat the person normally if they remain at work | A change in your behavior is a tip-off and, if they are innocent, unfair | Same meetings, tone and allocation unless instructed otherwise |
| Look after your team without disclosing | People notice absences and access changes and fill the gap with speculation | The agreed script: a review is under way, you cannot discuss it, work continues, concerns go to a named channel |
What you must not do
Three mistakes do most of the damage in the cases auditors and investigators see, and all three come from good instincts. Managers confront because they feel responsible and want the truth from the person directly. They tidy records because they want to present a clean file. They tell the team because they value openness. Each is irreversible. A confronted subject can delete, warn an accomplice and move money before the evidence is secured. A tidied file is indistinguishable from a tampered one. A briefed team is a leaked investigation.
| Do not | Why it damages the case, or you | Do this instead |
|---|---|---|
| Confront, question or “give a chance to explain” | Tips them off before evidence is secured; invites deletion, collusion, fund movement; can breach the fairness steps HR owes them | Say nothing to them; tell the lead what you suspect and why |
| Tip off indirectly: “be careful what you email,” a sudden review of their work, a quiet access change | Same effect, harder to explain later | Change nothing unless instructed in writing |
| Delete, tidy, reorganize, back-date or “complete” any record | In many jurisdictions altering evidence carries legal consequences; innocent tidying looks identical to concealment | Freeze everything; if a record is incomplete, leave it so and say so |
| Discuss it with your team or peers | Harms an innocent person, alerts a guilty one, can expose the reporter | The agreed script, nothing more |
| Try to learn who reported it, or treat a suspected reporter differently | Retaliation is prohibited by most policies and, in many jurisdictions, by law; asking is itself a problem | Assume you will never know and that it does not matter |
| Interview your own staff about what they saw | Creates inconsistent accounts and contaminates witnesses | Tell the lead who might know something |
| Make promises: “it will be fine,” “nobody is losing their job” | You cannot keep them and they will be quoted back | “I can’t discuss it and can’t predict it. Here is where to take concerns.” |
| Negotiate privately: repayment, resignation for silence, a quiet exit | Can be unlawful in some jurisdictions; can prejudice an insurance recovery; loses the evidence and the deterrent | Leave every outcome to counsel and HR |
| Contact the vendor, customer or bank involved | Alerts a possible accomplice; damages a relationship if the suspicion is wrong | Route external contact through the lead and finance |
| Speculate in writing: emails or chat about “the fraud,” names in subject lines | Everything you write may be produced; speculation reads as prejudgment | Keep the log factual; raise sensitive points with the lead in person |
The manager’s preservation checklist
A formal hold notice, when it comes, will tell you what to keep. The gap it does not cover is the period before it arrives and the things in your area counsel does not know exist: the delivery dockets in the yard office, the spreadsheet on a supervisor’s desktop, the key-holder list for the stockroom. Your job is to make sure nothing in that gap changes, and to tell the lead what exists and where. In a routine audit you choose what to send, as the guide to what counts as audit evidence explains; in an investigation you send nothing unasked and change nothing at all. Two things are lost quickly. Badge, CCTV and some system logs are often retained only for short periods, so ask IT or security to preserve them on the first day. And devices belonging to anyone who leaves or is suspended must not be wiped or reissued under the normal leaver process; the first 48 hours guide’s worked case shows a handheld reissued under routine practice and five months of transaction history lost with it.
| Category | Where it lives | Do now | Do not |
|---|---|---|---|
| Email and chat | Your mailbox, team channels, the subject’s mailbox | Ask whether a server-side hold is in place; keep drafts and deleted items | Forward bulk material to legal unasked; delete “irrelevant” threads |
| Shared drives and local files | Process folders, trackers, desktop spreadsheets | Stop archiving and clean-ups; list locations for the lead | Rename, move or “reorganize for clarity” |
| System records and master data | Approvals, workflow history, vendor and customer masters | Ask for master data to be frozen or snapshotted | Edit the vendor record, close the PO, reverse the entry |
| Paper | Invoices, delivery notes, cash logs, sign-in sheets | Lock it; record who holds the key and who accesses it | Box it up for legal unasked |
| Devices | Laptops, phones, handhelds, tokens of leavers or suspended staff | Label, lock away, tell IT and the lead; suspend wipe-and-reissue | Wipe, reissue, or “just check what’s on it” |
| Physical access and video | Badge logs, visitor books, CCTV, key registers | Ask security to preserve today | Assume it will exist next month |
| Automatic deletion | Retention schedules on mail, chat, logs, drives | Get IT’s written confirmation that auto-deletion is suspended | Assume the hold notice did it |
| Work in progress | Open orders, pending approvals, half-done reconciliations | Ask the lead how to proceed; document the interim procedure | Quietly finish the subject’s work |
Your own position: witness, manager of the subject, subject or reporter
Being a witness is not being a suspect, and most managers in this situation are witnesses: people who hold records, approved transactions in good faith and can explain how the process actually ran. The next most common position is the manager of the subject, whose supervision will be examined as a control question (what did you approve, what did you see, what did the policy ask of you) rather than as an accusation. A small number of managers are subjects, and a small number are the person who reported the matter. Your conduct is the same in all four positions; what differs is how much you should know about your protections and when to seek advice of your own.
Three pieces of general background help. First, the opening statement in an investigation interview. In the United States it is called an Upjohn warning, after Upjohn Co. v. United States (1981), in which the Supreme Court held that communications between a company’s lawyers and its employees during an internal investigation can be protected by attorney-client privilege. The warning tells you that the lawyer represents the organization, not you; that the privilege is the organization’s to keep or waive; and that the organization may share what you say with regulators or others. It is routine, not a sign that you are a target. Second, representation. In unionized US workplaces, according to the National Labor Relations Board, a union-represented employee who reasonably believes an investigatory interview could lead to discipline may request a union representative (Weingarten rights); under current Board law the right belongs to union-represented employees only, and other jurisdictions have their own rules on accompaniment. Third, whistleblower protection. In many jurisdictions people who report suspected wrongdoing in good faith are protected from retaliation. Under Section 806 of the US Sarbanes-Oxley Act, as described in OSHA’s fact sheet, employees of public companies and other SEC-reporting companies, and in many cases of their subsidiaries, contractors, subcontractors and agents, are protected when they provide information or assist in an investigation concerning mail, wire, bank or securities fraud, SEC rule violations or fraud against shareholders, with complaints to OSHA due within 180 days. Directive (EU) 2019/1937 requires EU member states to make private-sector entities with 50 or more workers operate internal reporting channels that acknowledge a report within seven days, give feedback within three months of that acknowledgment and keep the reporting person’s identity confidential, with protection extending to facilitators and connected third persons. If you are the reporter, read your organization’s policy, use the designated channel, and keep a dated record of anything that feels like a consequence.
| Your position | What it means | What to do | When to seek your own advice |
|---|---|---|---|
| Witness | You hold records or approved transactions; no allegation concerns you | Cooperate, preserve, log; answer precisely; correct the record if you misremember | Rarely; perhaps if asked to sign a statement you are not comfortable with |
| Manager of the subject | Your supervision is a control question | Be candid about what you knew and when, including things you noticed and let go; neither minimize nor inflate | If your own approvals become the center of the questions |
| Subject, or possible subject | Your conduct is under examination; policy usually gives you the allegation in general terms and a fair process | Cooperate truthfully; alter nothing; discuss it with no colleague; take no company records “for your file” | Early: as soon as you are told, or reasonably believe, that you are a subject |
| Reporter | Your identity is usually protected; retaliation is prohibited by policy and, in many jurisdictions, by law | Keep using the designated channel; investigate nothing further yourself | If you experience what looks like retaliation |
Whatever your position, one line every experienced investigator would want you to hear: the cover-up is pursued more often than the mistake. A manager who approved something he should have checked has a control finding to answer for. A manager who, after the questions started, back-dated an approval or deleted an email has a different problem altogether. Honesty about an imperfect record is survivable. The alternative is not.
If you are interviewed
The general craft, and the sixteen questions auditors ask in a routine engagement, are covered in the guide to being interviewed by internal audit. An investigation interview differs in four ways: it is unannounced or short-notice, it is about specific events rather than the process, two people attend and one writes, and it opens with the privilege statement described above. Separate what you know from what you assume. Date things. Point to the record rather than describing it from memory. Nothing is off the record.
| Moment | Say | Do not say |
|---|---|---|
| The opening statement | “Understood. Am I being interviewed as a witness, and what does the interview cover?” | “Do I need a lawyer?” as a reflex |
| A specific approval | “On the 14th I approved the weekly batch. I checked the total against budget; I did not check line rates, because the procedure did not require it. The email is in my sent items.” | “I always check everything carefully” |
| Something you do not remember | “I don’t remember. My calendar and the workflow log for that week would show it.” | A guess offered as a memory |
| Something you noticed and let go | “I noticed the vendor’s address was residential in March. I did not follow it up. I should have.” | Inflating what you suspected, or omitting it because it is uncomfortable |
| A colleague’s motives | “I can tell you what I observed on these dates. I can’t speak to why.” | Speculation about guilt, debts or lifestyle |
| A summary that is not quite right | “That’s not quite what I said. What I said was…” | “Yes, more or less,” to end the discomfort |
Keeping the business running while access is restricted
Investigations run on their own clock: a single-person expense matter can be resolved in days, a vendor scheme that spans years and several branches can take months. In the meantime you have orders to ship and payroll to run. The rule is that every interim arrangement is formal, written and approved by someone other than you, because every arrangement you make in this period will be read later with hindsight. Practitioner judgment: budget a tenth to a fifth of your week for several weeks for requests, interviews and the extra care your own approvals now need, and tell your executive that early. If you are that executive, the executive’s guide to being audited is written for your chair; your decisions on cover and delegation in this period will be read with the same hindsight as the manager’s.
- The subject’s approvals. A formal temporary delegation to a named person under the delegation-of-authority policy, approved by your executive; never “just sign for him.”
- A frozen vendor or customer master. New or changed records only through a controlled exception reviewed by finance, with a log showing reason and reviewer.
- Held payments to a counterparty. One agreed script, all contact through finance; you do not explain and you do not apologize on the organization’s behalf.
- Suspended or narrowed system roles. A time-limited temporary role with logging and an expiry date; no shared logins, ever.
- The subject’s unfinished work. Reassigned on the lead’s instruction, with a handover note describing the state in which it was found; the half-finished state may itself be evidence.
- A deadline that depends on restricted records. Tell the lead early; preservation can be sequenced to release what you need.
Questions to ask the investigation lead
You are entitled to instructions, and asking for them marks a manager who understands the situation. Ask these in the first conversation, write the answers in your log, and ask again when circumstances change. Some answers will be “I can’t tell you that,” which is itself an answer.
| Question | Why it matters | What a good answer sounds like |
|---|---|---|
| Who is leading this, and who is my single point of contact? | One channel prevents inconsistent instructions | A name, a role, a phone number |
| Am I a witness, or a subject? | Determines whether to seek your own advice now | A direct answer, or “I can’t say yet, but I will tell you if that changes” |
| What should I preserve, and is a written hold coming? | Closes the gap before the formal notice | A list, and a date for the notice |
| Who may I tell, and what exactly may I say to my team? | Prevents a leak you did not intend | A short script, in writing |
| What do I do about the person’s pending approvals, work and access? | Keeps the business moving without improvising | Specific interim instructions, or a time by which you will have them |
| Is the routine audit paused, continuing or closed? | Tells you whether to keep answering the audit team’s requests | One of the three, and who will tell you if it changes |
| What do I do if the person approaches me about it? | They may, and you need a line ready | “Say you can’t discuss it, refer them to HR, and tell me the same day” |
| What if a customer, vendor or regulator asks? | External contact is the easiest way to lose control of information | A named person to refer them to, and a holding line |
| Is there anything I should stop doing today? | Payments or shipments may need to pause; you should not decide that alone | A specific instruction, or “no, carry on as normal” |
| How will I know when this is over, and what will I be told? | Sets expectations for a process you will mostly not see | An honest account of what managers are usually told at closure |
What happens after
Investigations end in one of four ways: not substantiated, substantiated against an employee, substantiated with management involvement, or inconclusive. Whichever it is, two things follow for you. The first is a control conversation. Fraud that ran for any length of time ran through a gap, and the audit report that follows an investigation describes the gap, its root cause and management’s actions, usually without naming anyone. The ACFE’s 2026 report found that more than half of all cases involved either a lack of internal controls or an override of existing controls, which is why the report will be about controls even when the loss was caused by one person. The second is a supervision question, asked of you if you managed the subject: not “did you know” but “what did the design of your review allow you to know, and what did you do with what you saw.” Answer it as candidly as you answered the investigators.
| Outcome | What you will see | What it means for you |
|---|---|---|
| Not substantiated | Quiet closure; the person returns; restrictions lift | Welcome them back without discussing it; control findings may still follow, because the gap existed even if nobody exploited it |
| Substantiated against an employee | HR action; recovery or insurance claim run by counsel and finance; sometimes a law-enforcement referral; a control-focused audit report | Management responses to write; expanded testing in your area; supervision questions answered as a control matter |
| Substantiated with management involvement | A wider investigation; the audit committee informed; in listed and regulated organizations, possible external disclosures | Repeat interviews; longer restrictions; more formal communications |
| Inconclusive | Control changes and monitoring; the person may remain with narrowed duties | The hardest outcome; follow HR’s instructions exactly and treat the person fairly |
| The report and follow-up | Findings about controls, cause and action, usually unnamed; a rating that may be severe; validation of your actions; the same test at sibling locations | Dispute facts if they are wrong, not the existence of the gap; build the evidence of your fixes from day one |
If the report carries a hard rating, the guide to an Unsatisfactory rating covers who sees it and what the first weeks look like. Your response is written like any other, with an owner, a date and the evidence that will prove it done: the guide to action plans that close is the method, the management response examples give the wording, and the 90-day remediation plan shows how to build the evidence of your fixes from the first week rather than the last. Your team will need a debrief when you are allowed to give one, delivered without blame and without a villain story. And your own record will be shaped less by the fact that fraud happened in your area than by how you conducted yourself once it surfaced. Practitioner judgment, from the restricted memos auditors write afterward: the manager who cooperated, preserved, kept the channel clean and answered candidly about the thing he missed is remembered as part of the solution. The one who confronted, tidied and briefed the team is remembered as part of the problem, whatever the investigation concluded about the original loss.
Worked example: Calder Building Products
This example is hypothetical and the organization is invented. Calder Building Products distributes roofing and siding from nine branches. Internal audit schedules a four-week audit of purchasing and inventory at the Westfield branch. The branch operations manager, who approves the weekly freight invoice batch among other things, has been through two audits before and expects a third like them.
| Day | What the branch manager saw | What was happening | What he did |
|---|---|---|---|
| 9 | The audit senior asked for every PO and invoice for one freight vendor, Ridgeway Haulage, onboarded 19 months earlier, and who approved each | Analytics had matched the vendor’s bank details to a branch employee’s relative; the senior told the CAE, who notified counsel | Answered factually (he approves the weekly batch total); provided the approval emails; did not ask why |
| 10 | IT: “no changes to the vendor master until further notice”; the buyer’s remote access “under maintenance” | Silent preservation: the buyer’s mailbox imaged that evening, vendor master snapshotted | Noticed the pattern; called the audit senior, who could not discuss it; said nothing to the buyer or anyone else; started his log |
| 11 | A preservation notice from the general counsel’s office covering freight, vendor onboarding, the buyer’s communications and the branch drive | Outside counsel and a forensic accountant engaged | Listed the delivery dockets, the freight spreadsheet and his approval emails; locked the docket cabinet and logged the key; asked security to preserve badge logs |
| 12 | A 70-minute interview with outside counsel and the forensic accountant, opening with the Upjohn statement; that afternoon HR placed the buyer on paid leave, purchasing was re-routed to the regional buyer, and a two-sentence team script was issued | Witness interview; containment; insurer notified by counsel the same day | Said he checked batch totals against budget, not line rates, because the procedure did not require it; said he had noticed in March that the vendor’s address was residential and had not followed up; asked whether he was a witness (yes); used the script verbatim; approved freight only with a line-level rate check under a written interim procedure |
| 13 to 30 | Occasional record requests; a vendor called about held payments; one team member asked whether the buyer was “in trouble” | Quantification and further interviews | Routed the vendor to finance; used the script; told the lead the same day that the question had been asked |
| 34 | Told the review was concluding and the buyer would not return | Substantiated: the buyer’s brother-in-law owned Ridgeway; inflated rates and invoices for loads never carried, about $212,000 over 19 months; dismissal; law-enforcement referral by counsel | Asked what he could now tell his team, and when |
| 41 | The audit report: new vendors onboarded without an ownership or conflict check (High); freight batches approved without rate verification (Medium); branch rated Needs Improvement; no names | The restricted investigation memo recorded that his approvals were within policy and that the policy was the weakness | Wrote the response: a freight rate table, line-level approval above a threshold, conflict-of-interest declarations for buyers, regional review of new vendors |
The counterfactual is the point. Had the manager asked the buyer on day 10, “is there something going on with Ridgeway?”, the mailbox image taken that evening would have followed a deletion spree rather than preceded it, the brother-in-law would have been warned before the bank was asked to hold anything, and the case would have rested on reconstructed data instead of original records. The manager did nothing heroic. He noticed, he did not improvise, he asked, he preserved, and he told the truth about the residential address he had let go. That is the whole job.
The longer lesson: red flags you can watch for
Internal audit visits your area every few years. You are in it every day, and the ACFE’s numbers say that is where detection mostly happens: tips were the most common detection method in the 2026 report, at 43% of cases, with more than half of them from employees, and 84% of perpetrators displayed at least one behavioral red flag before detection. The classic lens for why people cross the line is Cressey’s fraud triangle: a pressure the person cannot share, a perceived opportunity, and a rationalization. You cannot see the first and third from your chair. You can see the second, because opportunity is made of the controls you own. Two cautions. Behavioral flags are context, never evidence; in the 2026 report, living beyond one’s means (39%) and financial difficulties (29%) led the list, and both describe a great many honest people. And the full library of transaction-level flags, with the tests auditors run and a method for scoring a cluster, lives in the fraud red flags library; what follows is the shorter list a manager can notice without running a query. A gap you find and report yourself is treated differently from one the auditors find, and the guide to self-identified issues explains how to raise one.
| What you can see from your chair | What it might mean | What to do, and not do |
|---|---|---|
| Someone who never takes leave, resists cross-training, or insists on personally handling one vendor or account | Concealment needs continuity; schemes unravel when someone else does the job for two weeks | Enforce leave and rotation for everyone; do not single the person out |
| A vendor whose address matches an employee’s, has only a mailbox address, invoices in unbroken sequence, or bills just under your approval limit | A shell or related-party vendor, or splitting to stay beneath review | Write down what you saw; raise it with internal audit or the speak-up channel; do not call the vendor or the buyer |
| Overrides, exceptions, credit notes or manual adjustments concentrated in one person | A workload problem, or the mechanism of a scheme | Ask for the exception report as a routine; do not run a one-off “audit” of one individual |
| Customers or vendors saying their records do not match yours | Classic signal of skimming or lapping | Log each complaint; route to finance and audit; do not let the account handler “sort it out” |
| A reconciliation always late, always “in progress,” always done by one person with no reviewer | Unreconciled time is where differences hide | Insist on a reviewer who is not the preparer |
| Hostility to review, “just this once” requests to skip a step, pressure to approve quickly | Opportunity being engineered | Slow down precisely when pressed to speed up; keep the approval in the system |
| Unusual closeness with a vendor or customer: gifts, travel, after-hours contact | Possible conflict of interest; 17% of perpetrators showed this flag in the ACFE’s 2026 report | Apply the gifts and conflicts policy to everyone; note specifics; raise through the channel |
| Your own approvals have become a formality: batches, totals, a signature on a stack | The opportunity sits with you, not with them | Redesign the review to look at the line, the rate and the counterparty; the one flag you can fix alone |
The durable answer is design, not vigilance. The fraud in the worked example lived in two gaps the branch manager could have closed years earlier: a vendor could be onboarded without anyone checking who owned it, and a freight batch could be approved without anyone looking at a rate. Most of what makes an area hard to defraud is unglamorous: segregation of duties that survives staff turnover, user access reviews that actually remove access, mandatory leave with someone else doing the job in the meantime, approvals that look at line items rather than totals, and a named owner for each control, which is the subject of the guide to control ownership. For the program view, the COSO and ACFE Fraud Risk Management Guide (second edition, May 2023) is the reference many audit functions work from; the guide to running a fraud risk assessment shows how the scenarios are built, and the ACFE fraud tree gives you the vocabulary for what each gap would allow.
Culture does the rest. Employees tip when they believe someone will listen and nothing bad will happen to them for speaking. The year-round relationship with internal audit described in the off-season guide is part of that, and so is the climate in your own team: Edmondson’s work, summarized in The Fearless Organization, is about why people stay silent, and Heffernan’s Willful Blindness is about why managers do. The manager who reads this guide after the event usually recognizes, in hindsight, a flag he saw and explained away. The one who reads it before has a chance to be the tip.
This guide is general and educational; it is not legal or employment advice. Investigations are governed by your organization’s policies and by the law where you work, and if you are told you are a subject, or believe you may be, the time to seek your own advice is then.
Questions readers ask
How do I know if an internal audit has turned into an investigation?
You will rarely be told. Look for the cluster: questions about specific transactions and approvers rather than the process, a preservation or hold notice, the appearance of legal, HR or forensic specialists, access changes made through IT rather than through you, and the audit team going quiet about findings. Two or more together, and you should behave as if an investigation is under way.
Can internal audit investigate fraud, or does legal do it?
It depends on the charter and the investigation procedures. Internal audit can detect indicators, refer them and, where its mandate and skills allow, conduct or support the investigation; the IIA’s position is that auditors are not expected to have a professional investigator’s expertise. In most organizations the general counsel directs the investigation so that privilege applies. Deciding whether a crime occurred belongs to investigators, prosecutors and courts, not to auditors.
Am I in trouble if internal audit finds fraud in my department?
Usually you are a witness, not a subject. What will be examined is the control environment you ran: what your approvals checked, what the policy required, and what you did with anything you noticed. That is answered as a control finding, not as an accusation. The exceptions are a manager who ignored clear warnings, who benefited, or who interfered once the questions began.
Should I confront an employee I think is committing fraud?
No. Confrontation before evidence is secured gives the person the chance to delete records, warn an accomplice and move money, and it can breach the fairness steps HR owes them. Write down what you have seen, with dates, and take it to internal audit, the general counsel or the speak-up channel. Say nothing to the person and change nothing about their work or access.
Can I tell my team there is an investigation?
Only what the investigation lead or HR has approved, which is normally a short script: a review is under way, you cannot discuss it, work continues as normal, and concerns go to a named channel. Anything beyond that risks a leak, harms the person if they are innocent and can expose whoever reported the matter.
Do I need a lawyer if internal audit interviews me about fraud?
Most witnesses do not. The organization’s lawyers represent the organization, not you, which is what the opening statement means, so the question to ask is whether you are a witness or a subject. If you are told you are a subject, or your own conduct is plainly the center of the questions, most practitioners would say to seek your own advice at that point. This is not legal advice; policies and law differ by jurisdiction.
How long does an internal fraud investigation take?
There is no standard length. A single-person expense or petty-cash matter can close in days. A vendor or payroll scheme that spans years, several locations and third-party records can take months, particularly where bank records or law enforcement are involved. Ask the lead for a realistic estimate and plan interim arrangements on that basis.
Related guides
- Being Audited? hub — every guide for people on the receiving end of an audit, by stage.
- When Internal Audit Finds Fraud: The First 48 Hours Protocol — the auditor’s side of the same moment, hour by hour.
- A Fraud Red Flags Library by Business Cycle — 48 transaction-level flags, their tests and a triage method.
- When Internal Audit Interviews You — the routine interview, the questions asked and how to answer.
- What Internal Audit Can and Cannot Do — where audit’s access comes from and where it stops.
- The Escalation Ladder — how and when auditors go over someone’s head.
- The ACFE Fraud Tree Explained — the vocabulary of occupational fraud schemes.
- How to Run a Fraud Risk Assessment — building the scenarios your controls should answer.
- Fraud Risk Management and Internal Audit — prevention, detection and response as a program.
- Writing Management Action Plans That Actually Close — the response you will write after the report.
- Failed an Internal Audit? — what a severe rating means and the first weeks after it.
- When Your Division Is Audited: The Executive’s Week-by-Week Guide — the audit from the executive’s chair, from notification to the audit committee.
- The Fearless Organization (Edmondson) — why people stay silent, and what managers can do about it.
- Willful Blindness (Heffernan) — why the flag is so often seen and explained away.
Leave a Reply