Corporate Fraud Investigation: When Should You Act?

The cost of waiting

Corporate fraud costs UK businesses billions of pounds annually. The exact figure is difficult to pin down because most fraud goes unreported, and much of it goes undetected. What is clear from the cases we investigate is that the cost of fraud increases with every month it continues undetected.

The Association of Certified Fraud Examiners’ 2024 global study found that the median loss from occupational fraud was $145,000 (approximately £115,000), with the median duration being 12 months before detection. But these are median figures. We have investigated cases where the losses ran into millions and the fraud had continued for years.

The common thread in every delayed case is the same: someone suspected something was wrong but did not act because they were not sure, they did not want to believe it, or they did not know how to investigate without tipping off the fraudster.

Recognising the warning signs

Corporate fraud takes many forms: expense fraud, procurement fraud, payroll fraud, billing fraud, asset misappropriation, financial statement fraud, and intellectual property theft. The warning signs vary by type, but certain patterns recur across nearly all of them.

Financial anomalies that do not resolve

Discrepancies in accounts that nobody can adequately explain. Write-offs that seem disproportionate. Suppliers or customers that only one person deals with. Invoices from companies with no obvious web presence or public filings. Payments to companies with directors linked to your employees.

These anomalies individually might have innocent explanations. But when they cluster around a specific person, department, or process, they warrant investigation.

Behavioural red flags

An employee who refuses to delegate control of a process. Someone who works unusual hours, particularly when others are absent. Resistance to audits or process changes. A manager who bypasses established approval procedures. An employee whose lifestyle visibly exceeds their salary. Reluctance to take leave.

The last point is particularly telling. Fraudsters often cannot take extended leave because their scheme depends on their ongoing involvement. If someone else steps into their role for two weeks, the anomalies may become visible.

Whistleblower reports

Tips from colleagues are one of the most common ways fraud is initially detected. If an employee raises a concern, take it seriously. Investigate before dismissing it. The concern may be based on incomplete information, but it may also be the first indication of a serious problem.

When to investigate

The decision to investigate should be based on a realistic assessment of the potential harm versus the cost and disruption of an investigation. As a general guide, you should investigate when:

Financial anomalies persist after normal checks have failed to explain them. Multiple warning signs cluster around a specific person, process, or department. A credible whistleblower report has been received. You have identified transactions with entities that cannot be independently verified. Audit findings raise concerns that management explanations do not adequately address.

The mistake many businesses make is setting the threshold too high. They wait until they have “proof” before investigating, but proof is what the investigation is designed to produce. What you need to start an investigation is reasonable suspicion based on objective indicators.

Internal vs external investigation

Internal investigations

Your compliance team, internal audit function, or senior management can investigate certain matters. This is appropriate when the suspected fraud is low-value, the suspect is junior, there is no risk of the investigation being compromised internally, and you have staff with investigation skills and available capacity.

Internal investigations are cheaper but carry risks. The investigator may have relationships with the suspect. Word travels fast in offices. Evidence may be inadvertently contaminated. And if the fraud involves senior management, an internal investigation is compromised from the start.

External investigations

Bringing in external investigators is appropriate when the suspected fraud is serious, the suspect is in a position of authority, there is a risk of internal compromise, you need court-admissible evidence, and the matter may result in criminal prosecution or civil litigation.

External investigators bring objectivity, specialist skills, and independence. They have no internal relationships to manage and no organisational politics to manage. Their evidence carries more weight in legal proceedings because their independence is demonstrable.

How a professional investigation works

Phase 1: Scoping and planning

The investigation begins with understanding what you know, what you suspect, and what evidence exists. We review financial records, system logs, process documentation, and any internal reports. We assess the likely scope of the fraud, identify the key individuals and processes involved, and develop an investigation plan.

This phase also addresses practical issues: who within the organisation knows about the investigation, how will confidentiality be maintained, and what legal obligations exist (for example, reporting requirements under the Proceeds of Crime Act 2002).

Phase 2: Evidence gathering

This is the core of the investigation. Depending on the case, it may include financial analysis and transaction tracing, review of company systems, emails and documents (with appropriate legal authority), surveillance of suspects, background checks on individuals and connected entities, analysis of supplier and customer relationships, and interviews with witnesses.

All evidence is gathered within legal boundaries and documented to standards that will withstand scrutiny in court proceedings. This is critical: evidence gathered improperly can be excluded, and the investigator and the instructing party may face legal consequences.

Phase 3: Analysis and reporting

Evidence is analysed to establish what happened, who was involved, how much was lost, how the fraud was concealed, and what vulnerabilities allowed it to occur. The findings are presented in a full report that serves as the basis for decisions about disciplinary action, criminal referral, civil recovery, and remedial measures.

Phase 4: Aftermath support

We support clients through the consequences of the investigation: attending disciplinary hearings as witnesses, liaising with police if criminal prosecution is pursued, providing evidence for civil recovery proceedings, and advising on control improvements to prevent recurrence.

Legal considerations

Corporate fraud investigations operate within the rules of employment law, data protection law, and criminal law. Key considerations include the employee’s rights during investigation (they retain employment rights, including the right not to self-incriminate), data protection obligations (accessing company systems is generally permissible for investigation purposes, but personal data must be handled in compliance with UK GDPR), the duty to report certain offences under the Proceeds of Crime Act, and the risk of tipping off a suspect of a money laundering investigation, which is itself a criminal offence.

Professional investigators handle these requirements as a matter of routine. Getting them wrong can derail a prosecution, expose the company to employment tribunal claims, or create criminal liability for the investigators and those who instructed them.

The cost of investigation vs the cost of fraud

A targeted corporate fraud investigation typically costs between £5,000 and £25,000, depending on complexity and duration. Compare this to the median fraud loss of £115,000, and the calculation is straightforward.

But the cost of fraud extends beyond the direct financial loss. There is the management time spent dealing with the aftermath, the damage to staff morale, the potential reputational harm, and the cost of implementing controls that should have been in place.

Acting early reduces all of these costs. The sooner fraud is detected and stopped, the less damage it does.

Types of corporate fraud we investigate

Corporate fraud is not a single offence. It covers a range of dishonest behaviours, each requiring different investigation techniques and presenting different challenges.

Procurement fraud

An employee with purchasing authority directs contracts to a company they control or have an interest in, often at inflated prices. The kickback might be a direct payment, goods or services provided to the employee, or a share in the supplier company’s profits. Procurement fraud is particularly common in businesses where purchasing is controlled by a small number of people with limited oversight.

Expense fraud

Claiming expenses for journeys not taken, meals not eaten, or purchases not made. At the lower end, this might involve inflating mileage claims or claiming personal purchases as business expenses. At the higher end, it can involve fabricated supplier invoices, false conference attendance, or claiming for employees who do not exist.

Payroll fraud

Creating ghost employees, inflating hours, or manipulating pay rates. This requires access to payroll systems and often involves collusion between the fraudster and a payroll administrator. It can be difficult to detect if payroll processing is handled by a small team with limited oversight.

Asset misappropriation

Taking company property for personal use or sale. This ranges from pilfering office supplies to diverting large quantities of stock, equipment, or materials. In manufacturing and logistics businesses, asset misappropriation can represent major losses that are written off as waste, damage, or administrative error.

Intellectual property theft

Employees who take customer lists, trade secrets, product designs, or proprietary data when they leave, often to set up a competing business or to hand to a new employer. This type of fraud can cause damage that far exceeds the value of any physical asset, particularly if the information provides a competitor with market advantage.

Building a fraud-resistant culture

Investigation addresses fraud after it has occurred. Prevention reduces the likelihood of it happening in the first place. the strongest fraud prevention combines structural controls with cultural elements.

Structural controls include separation of duties, regular audits, access controls, approval hierarchies, and monitoring systems. These create barriers that make fraud harder to commit and easier to detect.

Cultural elements include leadership that visibly takes integrity seriously, clear policies with consistent enforcement, a safe channel for reporting concerns, proportionate responses to detected fraud, and a general environment where people understand that dishonesty has consequences.

Neither structure nor culture is sufficient alone. Strong controls in a culture that tolerates dishonesty will be circumvented. A culture of integrity without proper controls relies too heavily on individual honesty. The most fraud-resistant organisations combine both.

International dimensions

Fraud does not respect national boundaries. Procurement fraud involving overseas suppliers, payroll fraud exploiting offshore payroll processing, and asset misappropriation facilitated by international bank accounts all require investigation that extends beyond the UK.

UKPI works with established associates in key jurisdictions to conduct international fraud investigations. We can trace funds across borders, verify the legitimacy of overseas entities, and gather evidence that meets UK evidential standards regardless of where the fraud originated. International cases are more complex and take longer, but the principles of thorough, legal, evidence-based investigation remain the same.

The decision to investigate corporate fraud is rarely easy. It disrupts operations, creates internal tension, and forces difficult decisions about people you may have trusted for years. But the alternative, allowing fraud to continue unchecked, is always worse. Every week of delay increases the losses and makes eventual recovery more difficult. If you have reasonable grounds to suspect fraud, act now rather than later.

UKPI has investigated corporate fraud cases across all sectors since 1997. Our team includes former law enforcement officers and financial investigators with experience in complex fraud cases. Call 0800 043 1754 for a confidential discussion.