Most fraud investigations start the same way: an anomaly that will not reconcile, a tip-off nobody wanted to hear, a supplier that turns out to share a director's home address. What happens in the following 72 hours largely determines whether the business recovers its money, dismisses the right person lawfully, and preserves the evidence — or contaminates all three. Having run these investigations for years, here is how the process actually works, and the numbers that explain why it matters.
The shape of the problem
Occupational fraud is chronic, not exotic. The ACFE's 2026 Report to the Nations — a study of 2,400 investigated cases across 143 countries, so survey estimates rather than a census — puts the median loss at around $104,000, the average well over $1 million, and organisations' typical leakage at an estimated 5% of annual revenue. The median scheme runs twelve months before detection; frauds by owners and executives, and financial statement frauds, run about two years. Nine in ten cases involve asset misappropriation — theft, false invoicing, payroll and expenses schemes — while corruption (kickbacks, conflicted procurement) now features in almost half, and pure financial statement fraud is rare but ten times as expensive when it happens.
The UK picture matches: Cifas logged a record 444,000 fraud cases in its latest reporting year, with insider-fraud filings up 21%. And the single most reliable detection method, by a wide margin, is a tip — 43% of cases, mostly from employees. A working whistleblowing route detects more fraud than internal audit and management review combined, which tells you where prevention budgets should actually go.
The first 72 hours: preserve, don't confront
The instinct on discovering suspected fraud is to confront the suspect. It is almost always wrong. The right sequence:
- Contain access proportionately — where the evidence justifies it, suspend the relevant system credentials and payment authorities without announcing why, before any conversation; blanket lockdowns can themselves destroy evidence and prejudice fairness;
- Preserve evidence forensically — devices imaged, mailboxes and system logs captured with chain of custody intact. Evidence handled casually gets challenged later in tribunals and courts, and IT "having a look" at the laptop is how metadata dies;
- Involve lawyers early where litigation is realistic — investigations instructed through solicitors can attract legal privilege over the findings, which matters enormously once regulators, insurers or opponents start asking for the report;
- Decide the objective. Recovery, dismissal, prosecution, regulatory reporting and insurance claims pull in different directions; an investigation designed for all five at once serves none well.
How the investigation runs
A competent investigation is two disciplines braided together. The forensic accounting track reconstructs what happened: transaction analysis across the ledgers, matching of suppliers to employees, quantification of the loss year by year — the number that drives everything from the disciplinary charge to the insurance claim. The interview track follows the UK's PEACE model — planned, non-confrontational, account-based — because interviews conducted as ambushes produce unusable answers and constructive dismissal claims in equal measure.
Alongside both runs the employment process, with its own rules: suspension on pay where proportionate (not automatic), a fair disciplinary procedure under the ACAS code, and — a point that surprises boards — no obligation to wait for police or courts. Dismissal turns not on proving fraud like a court would, but on a reasonable belief formed after a reasonable investigation through a fair procedure — and employers who parked the disciplinary "until the criminal case finishes" have waited years for a verdict that never came.
On the money itself, the practical choice is usually civil recovery — freezing orders, proprietary claims, breach of fiduciary duty — rather than the criminal system: police capacity for fraud is what it is, the SFO takes only the largest and most complex cases, and a freezing order obtained in week two beats a conviction in year four for actually getting assets back. Reporting to Action Fraud (now Report Fraud) still belongs on the checklist; relying on it for recovery does not.
The new legal backdrop: prevention is now a duty
Since September 2025, large organisations face the failure to prevent fraud offence: criminal liability where an employee or agent commits fraud intending to benefit the organisation, unless reasonable prevention procedures existed. Every serious internal investigation now has a second question bolted on — not just "who did this and how do we recover", but "what does this incident say about our prevention framework, and are we now the ones exposed". The six-principle framework (risk assessment, proportionate procedures, top-level commitment, due diligence, training, monitoring) is covered in our corporate criminal offences guide, and post-incident remediation evidence has become part of the investigation deliverable itself.
Before anything happens: the cheap controls that work
The pattern across hundreds of ACFE-catalogued cases is consistent: frauds flourish where duties are unsegregated, overrides go unreviewed, suppliers are never screened against employee data, and concerns have nowhere safe to go. The corrective list is neither long nor expensive — dual authorisation on payments and master-data changes, enforced holidays, periodic employee-supplier matching, and a whistleblowing channel people believe in. Most six-figure frauds we have quantified would have died at month two against any three of those.
Acumon's forensic accounting team runs investigations end to end — preservation, quantification, expert reports for tribunals and courts — with anti-fraud reviews for the prevention side and forensic audit where the concern is systemic rather than individual. If you are looking at an anomaly right now: preserve first, confront later, and call before the laptop gets "had a look at".