It is critical that the people who conduct investigations have the requisite skills and experience. This includes the ability to interview people (and know when the interview should or should not turn into an interrogation) without damaging employee morale, an understanding of the law, and an appreciation of the policies, laws, and regulations applicable to the alleged or suspected incident. I prefer investigators to be formally trained and, when it comes to fraud, prefer people with the CFE credential.

By the way, lawyers generally assume that they know how to perform investigations. They are very often mistaken. I have seen executives exonerated when it was obvious (to me) that the lawyers had not talked to everybody or seen all the evidence, and had reached the wrong conclusion.

It is also critical that the investigation be conducted with an open mind. Sometimes, evidence that the suspects are ‘innocent’ only comes to light late in the investigation.

Only the people who need to know about the investigation should have such knowledge. My favorite investigations are those I conducted without anybody – especially the ‘suspects’ – knowing, and where I was able to demonstrate that the allegation was without substance without damaging the ‘suspect’s’ reputation.

Finally, the investigation should be thorough – to the point that either credible evidence is present to dismiss the allegation or sufficient to take action that would be supportable if challenged in a court of law.

The risks include:
- Obviously, there is a risk that an employee may be inappropriately disciplined – with litigation to follow.
- The possibility of litigation by employees who believe their reputation has been damaged. This may apply not only to the ‘suspect’ but by their manager and co-workers.
- The loss of valuable employees. Poorly conducted investigations can cause such a mess and destroy morale that key employees (even those not directly affected by the investigation) may leave.
- Damage to an employee’s reputation. Even if exonerated, if a manager knows that his employee was suspected, it is hard not to have that cloud the manager’s opinion of the employee.
- There is a risk that allegations will be incorrectly considered unfounded.
- The company’s reputation may be damaged if the fact of the investigation becomes public.
- Finally, the investigation can disrupt business by diverting attention from normal activities. I have seen a major investigation result in a drop in revenue of about 25%.

What risks have I missed? What precautions need to be taken?

Norman Marks, CPA, is vice president, governance, risk, and compliance for SAP's BusinessObjects division, and has been a chief audit executive of major global corporations for more than 15 years. He is the contributing editor to Internal Auditor’s “Governance Perspectives” column.
normanmarks.wordpress.com/