Five Phases of an Investigation

1. First receipt of allegation and mandate to investigate:

Internal and external forensic auditors have to ensure that a mandate for an investigation is obtained. Internal auditors need a signed letter of instructions from their employers, to obtain clarity in an investigation and protect the forensic auditor, and it can be presented to a witness to prove the identification of the forensic auditor. External auditors obtain mandate to investigate through an engagement letter from a client. If a forensic auditor receives an allegation of possible economic crime, the auditor needs to evaluate the given information about the possible crime and if there is sufficient evidence, the auditor can proceed to the planning and execution phase, but if there is only a limited amount of evidence, the auditor has to start a preliminary investigation. A preliminary is also needed to determine if a crime was committed, the extent of the crime, and who the perpetrators are.

2. The preliminary investigation:

Purpose:

• To determine whether allegations that a crime has been committed can be proven or disproven.
• To determine the nature of the crime.
• To determine who the perpetrators are.
• To determine what resources will be needed to investigate the crime.
• To compare the expenditure of the investigation with the success of an investigation.

A preliminary investigation is a fact finding mission to asses whether or not a full scale investigation should be conducted, and might not necessarily lead to prima facie proof of a crime.

Preliminary investigation focuses on:

• The lifestyle of the accountant (person in question).
• Other possible sources of income.
• Further indications that the person in question is living beyond his/her means.
• The sources of money that the person is receiving.
• A cursory evaluation of the company’s books in order to determine if there are any obvious shortages or manipulations.

If large electronic transfers were made from the company’s bank account by a person in question, or VAT or tax statements seem to have been manipulated by the accountant, or the accountant has a sudden change in spending patterns that can’t be explained, a full scale investigation has to be conducted.

The preliminary investigation ends as soon as soon as it is confirmed that there are objective reasons that a crime has been committed and that the accountant’s income is questionable. The mandatory must then be informed of all the findings by the forensic auditor, and the mandatory is then responsible for requesting a full scale investigation.

The main objective of a preliminary investigation is thus to determine if a full scale investigation is necessary.



3. Assessment, preliminary reporting and planning:

As previously stated, the mandatory is responsible for requesting a full scale investigation. This decision is based on a preliminary report where the forensic auditor has to report all facts that where discovered during the preliminary investigation pointing to the commission of a crime, and/or facts that prove the innocence of suspects and indicators that may point to the suspension of the investigation. If the preliminary report shows that further investigation is needed, and the mandatory decides that further investigation is necessary, the execution phase of the investigation is continued.

4. The execution phase:

The forensic auditor must perform all procedures in accordance with the investigation plan, and gather all evidence necessary for a successful prosecution. Two of the procedures that will always be performed are taking of affidavits and the gathering and interpretation of documentary evidence. The compilation of a case docket and the maintenance of an investigation diary are also important elements of all investigations.

There are numerous procedures that may be performed during an investigation, but there are no definitive blueprints that will fit all investigations. Some procedures may apply in some cases, and some may not. It is crucial to also know the law relating to investigation as described in the Criminal Procedure Act and other legislation. If the forensic auditor has no knowledge of the law, he or she would not know that the Police may apply for a search warrant in terms of the Criminal Procedure Act for the searching of premises and the seizure of evidence, or that a subpoena in terms of section 205 of the Criminal Procedure Act can grant the Police access to important information held by private persons and entities such as the banks, that would otherwise not be accessible for investigation purposes.

It should be noted that it is often beneficial for the forensic auditor to work and co-operate with the Police. It should be borne in mind that all evidence collected by the Police in terms of powers extended to them in the Criminal Procedure Act or other legislation are for the use of the Police in a criminal trial only. There are certain exceptions and permission may be obtained from the Director of Public Prosecution to utilize information in a police case docket for the purposes such as disciplinary hearings, etc.

A forensic auditor’s mandate very often includes assisting the Police with the investigation in order to prepare the matter for submission to the prosecutor.

5. Reporting:

The reporting phase could be regarded as the most important phase of a forensic audit. Regardless of how well the work was done, if the report is not written properly, the perception of the reader will be that the audit was not a success. The report must reflect the quality of an investigation.