The need for a special forensic investigation to look into financial crime often arises very suddenly. Whether it is the result of a tip-off (from an anonymous source), a chance discovery, a search by investigating authorities or a regulatory requirement, clients find themselves having to deal with the immediate situation unexpectedly. Suspicions may relate to any number of crimes, including corruption, money laundering, financing terrorism, cartels, cyber-attacks, embezzlement – the list goes on.

The first step is to fully understand the accusation or initial suspicion. What exactly do the accusations relate to and who is implicated? What is the time frame under question? It is also essential to clarify right at the start who needs to be informed and/or involved. At the same time, it is important to work out whether there is anyone who shouldn't be told about the accusations. This may include the person under suspicion and/or other, unaffected employees.
Many organisations are not prepared to take immediate action, such as the steps discussed above as well as measures like securing affected offices/business documentation or blocking access to electronic systems, or to subsequently investigate the situation. The other problem is that they often lack the necessary skills and/or resources.

The elements of a special forensic investigation that are generally required in order to pass judgement on a situation are outlined below. It may be the case that not all of these elements are required and we do also offer individual elements as separate services to fill gaps in skills or resources within internal investigations, for instance.

Document and process auditing, interviews

The aim of document and process auditing is to gather information relevant to the case with a view to assessing the situation. Just building a picture of processes and responsibilities can make it possible to narrow down the target group of potential suspects and important information can be gleaned on relevant documentation. The content of documents related to the situation is analysed, whilst the physical documents are checked for any signs of tampering or manipulation. The type of documents can vary greatly, with examples including contracts, invoices, service reports, payment files, accounting records and meeting minutes.

Interviews with relevant witnesses often provide useful information at the questioning stage. The suspects are then usually interviewed at the end of the investigation when lots of information is already available, as this can be used to confront them at this point. Interviews are conducted by two experienced interviewers and documented.

Business intelligence

Given that it is often necessary to also source information from outside of the company during an investigation, background research on physical and legal persons is usually very helpful in terms of revealing legal or financial situations, networks of contacts, sanctions lists, economic beneficiaries or relevant press releases, for example.

Forensic technology services

In the modern age, the use of electronic media is becoming increasingly important and, as a rule, it is essential that data undergoes a forensic analysis as part of the investigation into the situation. This process involves us securing the data so that it can be used in court and using state-of-the-art technology to evaluate it, with a focus on the risks and in compliance with data protection provisions. This is the same regardless of whether we are dealing with data from ERP or other systems, server data, or data from computers, mobile phones or other devices (e.g. emails). We also have the option to analyse considerable volumes of data in our lab or in a special IT area, which we can help set up at the client's company specifically for the purposes of the investigation.

Remediation

With a view to preventing future breaches, there is nearly always a need to fix shortfalls with the existing surveillance systems and perform optimisation work on them, taking liability and regulatory requirements into account. This can be achieved, for example, by adapting the internal monitoring system or compliance management system. Above all, this might involve optimisation of measures already in place to stop money laundering or to combat the financing of terrorism. It goes without saying that we are always happy to help with the design, implementation or optimisation of your existing systems whatever the reason behind the work.