By Cameron Field + David Malamed
Illustration: Susanna Denti
So you think you’ve uncovered fraud in your company. Here’s what you need to know before contacting police
Several years ago a large Canadian insurance company contacted the financial crimes unit of a major metropolitan police force. The company was certain it had uncovered a large-scale internal healthcare fraud.
Many companies opt to deal with suspected fraud on their own, preferring to keep the matter quiet for fear of public embarrassment or of losing the trust of customers or shareholders. They also worry about opening their doors to a police fraud squad. “Once we are asked to investigate, we can seize any relevant documents and interview anyone who might prove helpful,” a senior police fraud investigator says. “And sometimes in doing so we uncover other things the company would prefer we didn’t find.”
When companies do involve the police, many do not understand the preparation they need to undergo before taking that step.
In this case, however, the victimized company understood those obligations perfectly. And, as a result, the outcome was most successful.
There is a popular belief that a police financial crimes unit will only investigate frauds that involve a substantial loss quantum. That is not true.
A fraud, such as the grandchild-in-trouble scam, is an example of a matter that merits police attention even though it may not have cost the victim a significant amount of money. This scam, which can thank social media sites for providing con artists with extensive details about family relationships (names, ages, birthdays, itineraries, traveling companions and the like), targets elderly grandparents. The grandparents receive a phone call from someone purporting to be helping their grandchild who has been in a serious car accident or, if traveling abroad, has been jailed on some matter such as drug possession. Whatever the story, the caller asks for money to be wired immediately to help pay for medical costs or bail or bribes. The fabrications are legion and clever and, to some victims, most believable, especially since the caller seems to know personal details about the grandchild.
A police unit doesn’t need much motivation to track down and stop such heartless crimes, likewise affinity, renovation and other frauds that prey on elderly and vulnerable victims.
A substantial corporate fraud, however, is a different challenge for a police financial-crimes unit. Typically, it involves countless documents and timelines that span years, if not decades. The nature of the scam can be incredibly complex and hard to follow, even for an experienced fraud investigator.
Therefore, before a company contacts the police it has to do groundwork on its own. If it doesn’t, there’s a strong chance the police won’t be able to take on the case, especially as resources these days are stretched thin.
The large insurance firm is a classic example of a victim doing it right. A month before meeting with the police, the company discovered through a random audit that numerous employees had been claiming health benefits for seemingly fraudulent reasons. The company had a large staff and processed thousands of claims, virtually all legitimate, an-nually. The audit discovered that some employees, however, had an unusually large number of claims, well above the norm. A subsequent investigation showed these claims, which required notes from authentic medical institutions, were false. The attached medical notes were doctored, so to speak. The quantum loss was several hundred thousand dollars.
Once the insurance firm knew it had a serious problem, it acted quickly and professionally. It struck a confidential internal committee that included its CFO, general counsel, external counsel, the head of security, the CIO and an external forensic accounting firm, which employed former law enforcement investigators, one of whom was assigned to the case.
The committee debated whether to handle the matter internally or to involve the police. “We want the guilty people prosecuted under the law,” the CFO said. “We want everyone in the company to know this kind of behaviour won’t be tolerated. A message has to be sent out.”
As a result, the former investigator suggested it was best that he not conduct interviews at this time. “You don’t want some lawyer saying later in court that his client thought I was an officer of the court, a person of authority, and challenging whether his client was properly represented or anything else he can throw up as a red herring,” he said. “Some judges are very sensitive to that kind of stuff. Let the police do that work. What we have to do is make it possible for them to take on this file.
“We can’t just walk in and talk to the police about the fraud,” he noted. “We need to provide as close to a turnkey investigation as we can, within our circumstances.” That meant, he told the committee, the forensic accounting firm needed to prepare information that was detailed, clear, thorough, convincing and easily searchable.
When the forensic accountants, in conjunction with the company’s IT and security personnel, completed their work, the company called the police. They arrived with four bankers boxes full of binders. One binder had an overall executive summary that outlined the case in language that was easy to understand. Each binder was meticulously tabbed and indexed. Each had a clear, concise executive summary of its contents. Everything in the boxes had been burned onto CDs with searchable indexes.
The files contained a list of approximately 400 separate incidents of alleged healthcare fraud along with the names of the individuals associated with each allegation. A search by incident or by suspect’s name revealed every match within seconds.
The police began an investigation that resulted in numerous charges of fraud under $5,000 being laid against a number of employees. Many convictions followed.
“They had their ducks in a row when they came to us,” the head police investigator said. “That’s the kind of sophistication I wish more of our private-sector partners showed.”
Once a company brings a possible fraud case to the police it initiates an investigation even if the police ultimately decide not to pursue the matter. “Oftentimes they don’t realize that once they report the crime to us and we accept their documents and meet with their security people and their forensic accountants that we have started to investigate their incident,” says a financial-crimes unit officer. “As we go through the process, whether or not we accept the case for investigation, the intake process has begun and we’re likely almost a quarter of the way through.”
That means a significant amount of digging will have taken place — and the company will have lost any control over what is discovered. “For example,” the officer says, “if the loss involves investment income then the source of the income will be asked. If it is profits from another investment then the victim will be asked if those profits were declared as such to Revenue Canada. If they haven’t, we have no choice but to inform CRA of our findings.”
Nor do the police have to limit their investigation to the identified suspects. If the evidence points to others being involved, including trusted senior officials at the company, there is no way the company can prevent arrests or public reporting of that finding. “If we open a Pandora’s box, then so be it,” says the officer.
The key for companies contacting the police, as noted, is in their preparation before making that call. Obtaining and organizing the supporting documents is critical. But it’s not just a collection exercise. The documents must tell a story, one that convincingly portrays a fraud in a professional format. “We’ve had people come in with what amounts to little more than scribblings on a napkin,” the officer says. “Maybe a memo or a bunch of emails or some points jotted down on paper. We’ll hear them out, of course, but can’t do much with something that flimsy. As much as possible, we want original documents and supporting evidence.”
It helps, he adds, if the people preparing the material are familiar with what the police require. “A lot of forensic accounting firms have former senior law enforcement officers working with them. They can be a great resource as they can walk the victim’s team through the steps that police require.”
Even better is a suggested plan for the investigation. “If the company’s experts did their work properly, there’s a good chance they learned what to focus on, what didn’t pan out and other tips that can help the police when they launch their investigation,” he says. “Some companies are nervous about offering this, thinking the police might be insulted that a private firm has suggested how they do their job. They shouldn’t be. We have respect for any work done at a professional standard. And trial and error is a great teacher. That doesn’t mean we won’t go where our instincts and experience tell us. But why would we want to pursue a line of investigation that competent people have already found leads nowhere?”
Victims must also be clear on one crucial matter: the police and the Crown are not debt collectors. “Understand that we feel awful when people lose their money,” says the officer. “But recovery is difficult in the best of circumstances. That’s not our priority. It’s not our job, either. If we can assist a victim in a civil matter, by testifying, and so forth, then we’ll do it. But most victims know, or come to realize, that getting a judgment and getting the money back are two different matters.”
A successful prosecution can be more easily achieved if the victimized company had effective risk mitigation and due diligence policies and procedures in place prior to the fraud. “Crowns never used to ask this but they do now,” a fraud investigator says. “Did they have unequivocal written codes of ethics? Did every employee have to read and sign a statement on the acceptable usage of company resources, such as computers and smartphones? That kind of thing.”
In the absence of such policies and procedures, she says, the next question a Crown is likely to ask is: what have you done since the fraud was discovered? “We want to know when you discovered the fraud, what do you know about it now and what have you done about it?”
One of the best answers, she says, is that it was researched by credible forensic accountants and experts who recommended certain steps to stop the problem from happening immediately and in the future and that those steps were implemented.
Although frauds often take many months to surface, especially because of the financial reporting cycle, it’s imperative the victim contacts the police as soon as it has conducted a thorough internal investigation. Undue delay can only help the perpetrators and possibly make investigation more difficult.
The decision to contact the police is obviously up to each company or victim. But the insurance firm found it was well worth the effort to go to the authorities. Everyone at the company learned that fraud was taken seriously and that prosecution could result if they too took that route.
And sometimes it just feels right to know the perpetrators have been brought to justice.
Involving the police in a fraud investigation is a decision that should be taken after due consideration. A big plus is that the police can often uncover evidence that can’t be obtained internally. Police have the ability to obtain warrants to search and seize virtually every possible piece of evidence, even communications with legal counsel, provided the Canadian Charter of Rights and Freedoms has not been violated.
Yes, there can be a loss of control. But there can also be outcomes that make the work and effort well worthwhile.
Cameron Field, BAA, is a detective sergeant with the Toronto Police Service Financial Crimes Unit, Corporate Crimes Section and Social Media Team.
David Malamed, CA•IFA, CPA, CFF, CFE, CFI is a partner in forensic accounting at Grant Thornton LLP in Toronto. He is also CAmagazine’s technical editor for Fraud