An employee is suspected of fraud: the first steps

Preserve evidence and plan a fair process

Preserve evidence and assess immediate risks before making accusations. Tell the employee about an investigation as soon as possible; a short delay may be justified if there is a real risk of evidence being destroyed or witnesses being influenced. Record the reason, and review it. Suspicion is not a finding. Acas explains how to prepare an investigation.

Decisions about system access, contact with colleagues, and the sequence of interviews should follow the risks of this case. Take proportionate action to protect people, records, and funds without presenting the employee as guilty.

Keep the circle small

Limit information to people who need it for the investigation, support, or advice. Identify an impartial investigator and a decision-maker, and involve HR or a solicitor where appropriate. Confidentiality should not prevent the employee from obtaining appropriate advice or support.

Explain confidentiality expectations and record who has access to the evidence. Avoid workplace speculation and keep an open mind about explanations that do not involve misconduct.

Preserve the evidence

Relevant records can be deleted by people or overwritten by routine systems. Preserve material promptly, within a defined scope, and record what has been retained.

• Suspend routine deletion. Email retention, log rotation, CCTV overwrite cycles, and shared-drive clean-ups all destroy evidence on a timer. Tell IT, in writing, to preserve everything relating to the accounts, systems, and dates concerned, and to confirm they have done so.
• Secure the company’s own records. Financial records, expense claims, purchase orders, supplier files, access logs, timesheets, and the audit trail in the finance system. Take copies and keep the originals where they are.
• Record what the employee can access. Systems, physical areas, company cards, cheque books, stock, vehicles, client data. This is the list of what may need to be secured, and of what an investigation needs to look at.
• Preserve originals and record changes. Use a competent examiner where a device or account needs forensic examination. Document collection methods, timestamps, integrity checks where appropriate, and any unavoidable changes. Keep a chain of custody from the first collection.
• Keep contemporaneous notes. Who noticed what, when, and what was done about it, from day one. The note written at the time carries far more weight than the one reconstructed for a hearing.

Company ownership does not give unrestricted permission to search a device or account. Check authority, privacy expectations, employment policies, data protection requirements, and the relevance of the material. Personal accounts and devices require particular care; take advice before accessing them. Our guide on phone records and messages explains the distinction.

Monitoring and data protection

An investigation processes personal data. Record an appropriate lawful basis and collect only what is necessary. Allegations of offences and health information can trigger additional requirements. Covert monitoring needs a specific, exceptional justification, senior authorisation, and limits on scope and duration; assess privacy risks before starting.

Use the ICO’s monitoring-workers guidance when assessing transparency, necessity, and safeguards. An employment policy alone does not make monitoring lawful.

Suspension and fairness

Consider alternatives to suspension, such as adjusted duties or access, before deciding it is necessary. If suspension is used, explain that it is not a finding of misconduct, normally maintain pay and benefits, and keep its duration and necessity under review.

Use a fair process regardless of the strength of the initial suspicion. Investigate evidence both supporting and undermining the allegation, give the employee an opportunity to respond, and separate investigation and disciplinary decisions where practicable. Rights at an investigation meeting and a disciplinary hearing differ. Seek advice on the applicable employment rights, contractual procedure, and the Acas Code.

Treating the suspected employee differently from others in the same position, or on the basis of a protected characteristic, engages the Equality Act 2010 as well.

Who should investigate

A manager can run a small investigation where the facts are contained, the sums are modest, and nobody senior is involved. An outside investigator is the better choice where:

• the suspected employee is senior, or is the person who would normally investigate
• the evidence is in systems or accounts that need forensic handling
• the sums are large enough that recovery or a police report is likely, so the evidence has to be to a standard a court will accept
• the fraud may involve suppliers, customers, or other employees, and the picture outside the organisation needs establishing
• the organisation wants the investigation to be, and to be seen to be, independent of the people who noticed the loss

An investigation report sets out what was examined, what was found, and what it does and does not show, in a form that can be given to the employee at the disciplinary stage, to the police, to insurers, and to a solicitor bringing a civil claim. Our workplace and fraud investigation page describes the scope.

Interviewing the employee

Plan the employee’s interview at a stage that allows a fair investigation. It may happen early to identify explanations and further enquiries, with a later meeting if new evidence emerges. Explain the purpose, use open questions, record the answers accurately, and consider requests for support or reasonable adjustments. If criminal proceedings are possible, seek legal advice about interview procedure, recording, and any applicable caution requirements.

Police, insurers, and recovery

Suspected conduct may involve fraud, theft, false accounting, or other offences. Consider police reporting alongside any regulatory, contractual, or insurer notification duties. Reporting does not guarantee that police will open an investigation or recover money; preserve a clear chronology and supporting records so the report can be assessed.

Check the policy’s notification requirements promptly and avoid waiting for a completed investigation if earlier notification is required. A solicitor can advise on civil recovery and whether urgent protective applications are justified. An investigation does not itself freeze assets or guarantee recovery.

This is general guidance within the scope identified above. It is not legal advice and does not take account of your circumstances. Before a legal, employment, or court-related decision, seek advice from a solicitor in the relevant jurisdiction. Harwick provides investigative services; legal advice is a separate professional service.

Related services