An employee is suspected of fraud: the first steps

Do not confront anyone yet

The most common mistake is also the most natural one: calling the employee in and asking for an explanation. Done before the evidence is secured, it gives them the weekend to delete, shred and coordinate, and it commits the employer to a position before anyone knows what happened. A person who is confronted early and turns out to be innocent has a grievance; one who is guilty has a head start.

The same applies to quiet words with colleagues, to changing the employee’s access in a way they will notice, and to anything on email that they might see. Suspicion is not a finding. Treat the first days as the time to find out what happened, not to act on it.

Keep the circle small

Decide who needs to know and keep it to that: usually the person who noticed, one senior decision-maker, whoever will run the investigation, and, from early on, a solicitor. Everyone in the circle should understand that nothing is said to anyone else, including the suspected employee’s manager if that person is not in it.

A wide circle leaks. It also creates the impression, later, that the outcome was decided before the investigation began, which is the argument a tribunal will hear.

Preserve the evidence

Evidence in a workplace fraud disappears in two ways: the employee removes it, and the organisation’s own systems overwrite it. Both are prevented in the first days.

• Suspend routine deletion. Email retention, log rotation, CCTV overwrite cycles and shared-drive clean-ups all destroy evidence on a timer. Tell IT, in writing, to preserve everything relating to the accounts, systems and dates concerned, and to confirm they have done so.
• Secure the company’s own records. Financial records, expense claims, purchase orders, supplier files, access logs, timesheets and the audit trail in the finance system. Take copies and keep the originals where they are.
• Record what the employee can access. Systems, physical areas, company cards, cheque books, stock, vehicles, client data. This is the list of what may need to be secured, and of what an investigation needs to look at.
• Capture rather than alter. Where a device or account needs examination, an image is taken in a way that can be shown not to have changed anything, and the person doing it records what was done. Chain of custody applies from the first copy, because the documents may end up before a court or in a police file.
• Keep contemporaneous notes. Who noticed what, when, and what was done about it, from day one. The note written at the time carries far more weight than the one reconstructed for a hearing.

Company devices and accounts can be examined by the company, within what its own policies told staff to expect. Personal devices, personal accounts and anything the employee has been told is private cannot; our guide on phone records and messages explains where that line sits, and an employer who crosses it under the Computer Misuse Act 1990 hands the employee a defence.

Monitoring and data protection

An investigation processes the employee’s personal data, so the UK GDPR applies. The employer needs a lawful basis, which is usually its legitimate interest in protecting its property and its staff, recorded in a legitimate interests assessment. What is looked at should be limited to what the suspicion justifies. Covert monitoring of an employee is lawful only exceptionally, where telling them would prejudice the prevention or detection of crime, and it should be authorised by someone senior, limited in time and scope, and stopped as soon as the question it was set up to answer has been answered.

The regulator’s guidance on monitoring at work is the reference point, and a tribunal will ask whether it was followed.

Suspension and fairness

Suspension is not a disciplinary sanction, but it is not a neutral act either, and it should not be automatic. It is justified where the employee’s continued presence would risk further loss, interference with evidence or pressure on witnesses. Where it is used, it is on full pay, for as short a period as possible, and the letter says that it implies no conclusion.

Whatever the evidence looks like, the Employment Rights Act 1996 requires that any dismissal follows a fair process. For misconduct that means the employer genuinely believed the employee was responsible, had reasonable grounds for that belief, and had carried out as much investigation as was reasonable in the circumstances. The Acas code of practice on disciplinary procedures sets out the steps, and a tribunal can increase an award by up to a quarter where it was not followed. In practice the investigation and the disciplinary hearing are kept separate, the employee is told the allegations and shown the evidence before the hearing, and they can be accompanied.

Treating the suspected employee differently from others in the same position, or on the basis of a protected characteristic, engages the Equality Act 2010 as well.

Who should investigate

A manager can run a small investigation where the facts are contained, the sums are modest and nobody senior is involved. An outside investigator is the better choice where:

• the suspected employee is senior, or is the person who would normally investigate
• the evidence is in systems or accounts that need forensic handling
• the sums are large enough that recovery or a police report is likely, so the evidence has to be to a standard a court will accept
• the fraud may involve suppliers, customers or other employees, and the picture outside the organisation needs establishing
• the organisation wants the investigation to be, and to be seen to be, independent of the people who noticed the loss

An investigation report sets out what was examined, what was found and what it does and does not show, in a form that can be given to the employee at the disciplinary stage, to the police, to insurers and to a solicitor bringing a civil claim. Our workplace and fraud investigation page describes the scope.

Interviewing the employee

The interview with the employee comes at the end of the evidence-gathering, not the beginning. It is a fact-finding meeting, planned around the documents, with open questions and a written record. It is not a cross-examination, and a caution is not given: private investigators and employers are not the police, and the meeting is part of an employment process. Where a police investigation is likely, a solicitor should advise before the interview on how it is conducted and recorded, because a statement obtained under pressure is of little use to anyone.

Police, insurers and recovery

Fraud by an employee is an offence under the Fraud Act 2006, and theft, false accounting and money laundering under the Proceeds of Crime Act 2002 may also apply. Reporting to the police is a decision for the employer, but it should be made deliberately rather than by default: the police will investigate what is reported to them and the employer loses control of the timetable. Where a report is made, a well-evidenced file is what gets it taken up.

Tell insurers as soon as a loss is suspected if the policy covers employee dishonesty; late notification is a common reason for claims being refused. And where the sums justify it, a solicitor can pursue recovery from the employee through the civil courts, including freezing orders where money is at risk of disappearing; the evidence gathered in the first days is what those applications rest on.

This guide is general information about the law of England and Wales as we understand it at the date shown at the foot of the page. It is not legal advice and does not take account of your circumstances. Before acting on anything here, particularly where court proceedings, a criminal complaint or an employment decision are involved, take advice from a solicitor. We are investigators, not lawyers, and we will say so if a question you bring us needs one.

Related services