Immediate Steps: The First Hour
Do not alert the suspect. Do not access their computer, email, or files yourself - you may inadvertently alter metadata or destroy evidence. Do not discuss the discovery with colleagues who may warn the suspect. Document what you know: what was discovered, when, by whom, and what records are available.
Contact a civil fraud solicitor and a forensic accountant immediately. Many firms offer same-day or next-day emergency response. The forensic accountant should be instructed via your solicitor to ensure legal professional privilege protects the investigation findings.
Evidence Preservation
Preserve all financial records in their current state - do not delete, move, or modify any files. Secure backup copies of payroll records, expense claims, supplier invoices, bank statements, and email data. If your IT team needs to act, ensure they do so under forensic protocols that maintain chain of custody.
Note all system access the suspect had - payroll systems, accounts payable, expense approval workflows, and vendor master file administration. This information helps the forensic accountant scope the investigation efficiently.
Legal Professional Privilege
Forensic accountants working under legal professional privilege produce reports protected from disclosure to the opposing party. This requires instruction via your solicitor, not direct engagement by the employer. Privileged investigation reports allow your solicitor to assess the strength of your case and develop strategy without revealing your analysis to the suspect.
Direct instruction of a forensic accountant by the employer may waive privilege, making investigation findings disclosable in subsequent proceedings. Always engage via your solicitor from the outset.
Civil vs Criminal Route
You can pursue civil recovery, criminal prosecution, or both simultaneously. Civil proceedings focus on recovering money through asset tracing, freezing injunctions, and judgment enforcement - and typically recover more than criminal prosecution alone. Criminal proceedings focus on prosecution and POCA confiscation, which benefits the Crown rather than the employer directly.
Your solicitor and forensic accountant will advise on the optimal strategy based on the scale of fraud, available evidence, suspect's assets, and urgency. In most cases, civil proceedings should be initiated promptly while criminal options are evaluated.
HR Procedure and Employee Suspension
Follow your disciplinary procedure if suspending the employee, but coordinate timing with your solicitor and forensic accountant. Premature suspension may alert the suspect before evidence is secured. Conversely, allowing the employee continued access to systems risks further loss and evidence destruction.
Your solicitor will advise on the appropriate point to suspend, ensuring the investigation is sufficiently advanced to support a reasonable belief in gross misconduct on the balance of probabilities.
Insurance Notification
Many employer fraud losses are covered by fidelity insurance (employee dishonesty cover). Notify your broker promptly - policies often require notification within a specified period. Expert witness fees may be recoverable under the policy. Confirm coverage and notification requirements before instructing experts, as the insurer may have panel requirements or approval processes.