Lawyers Financial
Legal Suppliers

Preserving evidence paramount in suspected fraud cases

Organizations that have a strategy in place to deal with suspected fraud tend to have better outcomes than those caught off guard, Toronto forensic accountant and investigator Dave Oswald tells  

Preserving evidence can be tricky, but another challenge is trying to decide what to do with the suspect during the course of an investigation, says Oswald, the founder and owner of Oakville-based white-collar crime investigation boutique Forensic Restitution.

"We tend to underestimate the damage of fraud, but huge companies have been taken down by it," he says. 

When fraud is reported, the reaction by a company can be knee-jerk and the resulting panic may lead to mistakes, Oswald says.

Without a solid plan, the tendency is to start rifling through the individual’s computer, he adds.

“That’s the worst thing an organization can do because if they do find evidence on the computer, they then struggle to admit it as evidence in court because any good defence lawyer will just say it was planted by the company,” Oswald says. “It’s something people have to be very careful of and they really need to have a strategy in place.”

A plan will lay out how company officials react to a report of fraud. That can include using computer experts to preserve the digital evidence in a way that can’t be tampered with as well as imaging the computers and phones connected to those who are accused.

A pre-determined process will also identify how to keep paper documentation and access potential witnesses, Oswald says.

“It’s always better to be able to get that information before someone has wiped the evidence” he says.

Oswald points to one case where a suspect was asked to leave his computer outside his office door but was given enough time to replace the hard drive with a new one.

“He argued that someone must have replaced it after he had put it out to be collected,” he says. “If they had taken his computer from him immediately, and imaged it immediately, he wouldn’t have been able to make that claim.”

In addition, Oswald says the company would have been able to retain any evidence contained on the computer, which was entirely lost.

Once a hard drive has been overwritten, there’s no program that can retrieve it, he says. The only way to recover deleted data is if it resides on the computer as a deleted document or if it exists in the unallocated space, Oswald explains.

“It’s really important that companies have a plan,” he says. “They also need to think about what they’re going to do with the individual who has been accused,” such as putting them on leave or allowing them to continue working, he says.

“Often these are very senior people,” Oswald says. “That makes it very difficult for an organization to decide what to do in the moment if they don’t have a policy in place.

“These types of scenarios can be considered in advance so that when a whistleblower report comes in or you find fraud, you have a strategy for how to successfully investigate the case.”

Oswald was called into one company about three months after it had received a whistleblower report of fraud in which the individual was paid to leave the company. It was concerned with the reputational risk if word of the incident got out, he says.

The lack of a plan meant the individual could keep his computer over the weekend after he was told there was a problem.

“With a clear policy, they would have immediately seized the guy’s computer, mobile phone, and suspended him pending an investigation. That probe would have shown what he was up to. It would have given us the opportunity to interview him, which we never got. By the time we got there he had left the company,” he says.

“The company would have had a much better chance to prosecute or at least make a statement to the rest of the team that such actions would not be tolerated.”

To Read More Forensic Restitution Posts Click Here
Lawyer Directory
New Media Forensics (keep up until June 30, 2019)Hexigent Consulting (to remain until August 31/19)MKD International (post until Sept. 30/19)Feldstein Family Law (post until May 31/19)Lexop SJO Legal Koster Consulting & AssociatesNerland Lindsey