INVESTIGATIONS GUIDE
Suspected internal fraud: the first 48 hours
The first two days after a suspicion surfaces shape everything that follows. Quiet, careful steps now keep your options open later.
Last reviewed
Why do the first days matter so much?
Evidence of internal fraud is fragile. Emails can be deleted, laptops handed back and wiped, and paper files quietly removed. Someone who senses they are under suspicion has every reason to tidy up.
Your aim in these first hours is not to solve the case. It is to stop the record from changing, so that a proper examination can take place afterwards with nothing missing.
What should you preserve?
Think about every place the activity might have left a trace. Ask the right people to stop routine deletion, and keep a note of each request you make.
- Email accounts, including any automatic deletion or archiving rules, which should be paused.
- Company laptops, desktops and phones used by the person, left as they are and switched off only on specialist advice.
- Access logs for finance systems, shared drives, door entry and remote connections, exported before they roll over.
- Documents, spreadsheets and approvals connected to the payments or transactions in question.
- Original paperwork such as signed invoices, cheque books, delivery notes and petty cash records, kept together and untouched.
Backups matter too. Ask IT to set aside copies made before the suspicion arose, so that a later deletion can still be seen. If the person has left or is about to, keep their accounts and devices exactly as they were on the last day rather than reissuing them to a colleague.
What should you avoid?
Do not confront the person yet
A confrontation before the evidence is secure invites deletion and denial. Interviews come later, once the documents are understood.
Do not let IT clean up
Reimaging a laptop, resetting a phone or closing an account destroys material. Ask IT to change nothing and to record what they have already done.
Do not look through the device yourself
Opening files and messages alters dates the examiner will rely on, and can make it look as though someone tampered with the record.
Keep the circle small
Tell only the people who must act. Each extra person is another chance for a warning to slip out, and for rumour to harm someone who may be innocent.
Personal phones and private accounts belong to the employee. Do not take or open them without clear legal grounds; ask counsel first.
Why does the chain of custody matter?
A chain of custody is the record of who held an item, when and why, from the moment it was collected. Without it, the other side can argue that a document was swapped or a file altered, and the doubt alone can weaken strong evidence.
You can start one today with a simple log: the item, where it was found, who collected it, the date and time, and where it is now stored. When we take items in, they are logged on our own chain-of-custody record, and digital copies are given a cryptographic hash value so their integrity can be checked later.
Whether evidence is admitted is decided by the court in each case.
When should you bring in counsel?
Early, ideally within the first day. An advocate can advise on suspending the employee fairly, on reporting to the police, on any duty to tell regulators, insurers or auditors, and on whether to start civil recovery. If staff personal data is involved, they can also advise on your obligations under Kenya’s Data Protection Act 2019.
Bringing in counsel early also helps keep the investigation confidential, and reduces the risk that the disciplinary process or any court case is undermined by a hasty step.
Write down what you knew and when you learned it. That short note can matter later if anyone asks why the organisation acted, or held back, at the moment it did.
What comes after the first two days?
With the record secured, the examination can begin: tracing the transactions, matching them to approvals and messages, and building a timeline of who did what. Interviews follow once the documents are understood, and the findings then guide what you do next: discipline, recovery, a police complaint or stronger controls.
Terms in this guide
Questions
Should I suspend an employee suspected of fraud?
Sometimes, but take advice first. A suspension handled badly can tip the person off or be challenged later, so agree the timing with counsel and with whoever is preserving the evidence.
Can I check an employee’s work computer myself?
It is better not to. Even opening a file changes information an examiner may rely on; leave the device as it is and have a forensic copy made.
What is a chain of custody?
It is a log showing who collected each item of evidence, when, and everyone who has held it since. It helps show the evidence has not been changed.
Should I report internal fraud to the police straight away?
That is a decision to make with your advocate. Reporting is often right, but preserving the evidence first helps any police inquiry as well as your own.