Home > Risk > The risk of poor investigations

The risk of poor investigations

November 9, 2011 Leave a comment Go to comments

The front page of the latest issue of ComplianceWeek (November 2011 issue) has a lead article entitled: “Shop Talk: Conducting Internal Investigations”. The article makes interesting reading and I want to supplement it with some comments about the risks created when investigations are not done well.

It is critical that the people who conduct investigations have the requisite skills and experience. This includes the ability to interview people (and know when the interview should or should not turn into an interrogation) without damaging employee morale, an understanding of the law, and an appreciation of the policies, laws, and regulations applicable to the alleged or suspected incident. I prefer investigators to be formally trained and, when it comes to fraud, prefer people with the CFE credential.

By the way, lawyers generally assume that they know how to perform investigations. They are very often mistaken. I have seen executives exonerated when it was obvious (to me) that the lawyers had not talked to everybody or seen all the evidence, and had reached the wrong conclusion.

It is also critical that the investigation be conducted with an open mind. Sometimes, evidence that the suspects are ‘innocent’ only comes to light late in the investigation.

Only the people who need to know about the investigation should have such knowledge. My favorite investigations are those I conducted without anybody – especially the ‘suspects’ – knowing, and where I was able to demonstrate that the allegation was without substance without damaging the ‘suspect’s’ reputation.

Finally, the investigation should be thorough – to the point that either credible evidence is present to dismiss the allegation or sufficient to take action that would be supportable if challenged in a court of law.

The risks include:

  • Obviously, there is a risk that an employee may be inappropriately disciplined – with litigation to follow.
  • The possibility of litigation by employees who believe their reputation has been damaged. This may apply not only to the ‘suspect’ but by their manager and co-workers.
  • The loss of valuable employees. Poorly conducted investigations can cause such a mess and destroy morale that key employees (even those not directly affected by the investigation) may leave.
  • Damage to an employee’s reputation. Even if exonerated, if a manager knows that his employee was suspected, it is hard not to have that cloud the manager’s opinion of the employee.
  • There is a risk that allegations will be incorrectly considered unfounded.
  • The company’s reputation may be damaged if the fact of the investigation becomes public.
  • Finally, the investigation can disrupt business by diverting attention from normal activities. I have seen a major investigation result in a drop in revenue of about 25%.

What risks have I missed? What precautions need to be taken?

    November 9, 2011 at 12:18 PM

    How about if you do not do a proper investigation, then you will not have established perhaps the root cause of say a major defalcation and as a result, not make the necessary internal control improvements- thus subjecting yourself and the company to a repeat situation down the road, further wasting time in a repeat investigation

  2. Adam Witko
    November 10, 2011 at 6:39 AM

    Absolutely, there is need to approach the investigation in a professional, proper independant and objective manner, with due dilligence and the relevant technical expertise in order to get through, and there are some genuine demovation and disengagement risks involved.

    But what has been left out is probably the largest single macro level risk is that to shareholder wealth.The most obvious effect of a improperly performed investigation is the damage to share price.

    Frauds which are uncovered not through the internal control mechanism and result in restatement, have a disporportionate loss affect on share prices. 30-40% drops are not uncommon.

    If the intial finding was incorrect or loss understated , the loss of confidence can be catastrophic to share price and company survival.

    Depending on the regulatory system of the country, it also then result in numerous regulatory audits and investigations, potential class actions. In some authorities, investigations will not be single occurances, but ongoing until over many years until the authorities are satisfied.

    A properly managed investigation and fraud reponse plan may not eliminate these risks totally, but makes for a softer landing.

    In general, companies genuinely need to adopt adequate fraud response policies and have defined plans in place to minimise the damage which may arise. A properly defined policy and plan, will have in-built mechanisms to essentially manage the reputational risk effectively and contact with the authorities as/when required.

  3. November 10, 2011 at 10:03 AM

    Having done thousands of internal and external investigations in Corporate America, and having managed a corporate ethics hotline across a transnational company, I have a few thoughts on the topic of the risks associated with poor internal investigations.

    Before I get to that however, unlike in law enforcement situations, where investigators have the luxury of conducting interviews and interrogations, very seldom in “Corporate America are we afforded that luxury. More often than not, when we sit down to talk to someone in a corporate situation it is really considered more of an “interview” and not really an interrogation in the true sense of the word.

    I think the list is a good start but off the top of my head there are several other risks worth discussing. One of the greatest risks I see missing from this list associated with poor investigations is the “L” word: “LIABILITY.” Liability arises from mistakes made in the investigations process. We live in a very litigious environment and the penalty for getting it wrong in corporate investigations is significant. Accompanying liability are usually penalties, damages and fines. All of which potentially cost the company money well beyond their extensive legal fees.

    Risks of poor investigations also involve compromising potential criminal investigations and getting cases successfully prosecuted. Having evidence thrown out and the lack of a criminal conviction may again lead to increased liability issues on the civil side. Since for profit businesses are “bottom line” driven civil litigation, even when ultimately decided in favor of the business, can be extremely costly. Poor investigations may also be more costly in that they may ultimately prevent financial recovery and restitution awards.

    Another risk for poor investigation is the lack of any future deterrence in the employee population. The “they got away with it so why shouldn’t I?” mentality. Poor investigations in the private sector not only detract from deterrence efforts but they also expose internal controls and their weaknesses to other employees.

    Other risks involved in a poor investigation are the scrutiny it will bring from outside regulatory agencies (state and federal) monitoring transactions and events at a particular company. Not only are there significant business costs associated with those dealings, they detract from the course of regular business activities, they are time consuming and could ultimately involve penalties and fines for violations of federal laws like FCRA, SOX and EEO to name a few.

    Lastly, poor investigations erode the confidence in internal fraud and investigations teams making it harder for them to conduct investigations effectively going forward and maintaining the support of senior management. Thus, the effect of one poorly conducted investigation could have significant, long term impact going forward.

    Daniel W. Draz, M.S.,CFE
    Principal, Fraud Solutions

  4. Free
    November 10, 2011 at 4:18 PM

    I don’t think most investigation go bad because of poor techniques. Most of the time, it’s really up to the investigator to decide if he really wanted to report the findings. It’s no different from big 4 audit firms. Per discussions with some fraud lawyers, most big 4 audit failures occurred not because the audit procedures failed. The auditors actually found issues and the partners just decided not to report them.

    Looking at the Penn State case, it looks like the DA tried to report the Sandusky boy molestation case and was murdered.


  5. November 14, 2011 at 12:01 PM

    I would agree that poorly run investigations can certainly affect an organization and its individuals in a variety of damaging ways. Taking a slightly wider view of the topic, an ethics or compliance investigation begins with the original report and the how the resulting incident is managed. The protocols and procedures – collectively, the system – by which a case is administered is critical to the overall quality of the investigation. If an issue and incident is not processed in an efficient and effective manner, the results could have an adverse impact on your organization, much akin to sending an innocent man to prison.

    Consistency procedures are essential, and this is where investigative best practices come to bear. Such practices, if mandated and in place prior to the incident report being filed, can give an organization a head start to resolve issues quickly and comprehensively.

  1. No trackbacks yet.

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Google photo

You are commenting using your Google account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s

This site uses Akismet to reduce spam. Learn how your comment data is processed.

%d bloggers like this: