Inquiring Minds

The managing executives were concerned. The family-owned company they had acquired recently in a multimillion-dollar deal did not appear to be as profitable as they had expected. Threats had been made against their recently installed executive team, and an employee had come to them, in confidence, with a startling revelation: I think you're being bugged.

On behalf of the new ownership, Chris Marquet's investigations agency dispatched a team of 10 investigators and forensic accountants to do a little digging. The story they uncovered was worthy of a Robert Ludlum potboiler.

Under the purchase agreement, the new owners agreed that the founding family would remain in charge of the company's day-to-day management. A covert investigation of the family unearthed some interesting facts, such as the prior arrest of one family member on weapons and drug charges.

Even more disturbing, forensic accountants determined that the family had been using the company as their personal piggy bank. Corporate funds had financed homes, boats, cars, vacations and a number of other luxury items. Inventories, receivables and reserves had all been misstated to enhance the value of the company, and a cleverly designed computer program had defrauded customers by overcharging a small amount on each transaction at the point of sale. Fearful of discovery, the family was thought to be eavesdropping on the new management team. Interviews of current and former employees yielded a trove of other alleged crimes and misdemeanours, everything from sexual harassment and discrimination to suspicions of ties with organized crime.

"It was a can of worms, and it kept getting bigger," says Marquet, executive managing director and a founding principal of Citigate Global Intelligence & Security. Marquet says the investigation took place some years ago, before he formed Citigate, and he declines to name his client and the subjects of his inquiry. He says the five-month long investigation culminated in the firing of the family patriarch and three other family members, criminal charges being filed and a civil suit, the outcome of which enabled the company to recoup some of the estimated $US5 million that it had overpaid for its acquisition. And in firing the family, the company was no longer obligated to pay out their hefty five-year contracts.

Few CSOs will ever have to oversee an investigation of this magnitude. Background checks, off-colour e-mails and expense report cheats will compose a far greater percentage of an investigative team's caseload than will checking out surreptitious eavesdropping and alleged criminal activities. However, seasoned corporate investigators agree that regardless of the size and scope of a case, the core competencies of a good investigator and a well-managed investigation are largely the same - though by no means simple to master.

"It's an art form to be able to manoeuvre your way through some cases," notes Thomas Nihill, a former special agent for both the IRS Criminal Investigation Division and the US Department of Labor's Organized Crime and Racketeering Section, and now the managing principal of Nihill & Riedley forensic accounting firm.

We spoke with security executives, forensic accountants and corporate investigators, and uncovered their best practices and techniques for building a strong investigative unit and for successfully managing an investigation. Like any management skill, CSOs need to exercise their communication and leadership skills with investigators. Unlike other security professionals, however, corporate investigators are a specialized breed, and assembling a first-rate team requires cultivating members with a variety of singular skills. Some need the technical savvy to pick through financial and computer records. Others possess a sensitivity to human behaviour. All share a healthy respect for organization and process, however, and demonstrate the hallmark trait of all great detectives: dogged determination.

The Sensitive Side of Security

Building an investigative unit is not like erecting a new perimeter fence. It requires finesse and sensitivity. Investigations make people nervous. This is especially true in the corporate world where people worry about losing their jobs and nobody wants to be responsible for causing a fellow employee to lose his. That means that when questions come up, it's important to understand how those questions are perceived by the people who are giving answers.

This is true even in situations where there's not an investigation per se, merely a quest for information. Take one of the security executives we spoke with, who once received a phone call from a satellite office in South America. Employees there were concerned that an investigation was under way regarding cell phone usage. In reality, there was no investigation. The company was looking at ways to cut costs and eyeing cell phone bills. The process of doing so, however, stirred concern among employees who feared the I-word. (Employees calmed down once they heard it was a budget review.)

CSOs with experience building an investigative team say it's imperative to be sensitive to employees' perceptions, as well as cultural differences among far-flung employees working around the globe.

"Investigations have to be conducted with integrity and respect for individuals," says Ed Casey, chief security officer at Procter & Gamble. "You're making a judgment about someone's career, and that can create serious credibility problems for the security organization if it's not done properly. There have been many occasions where an employee is terminated by a company, and the employee has filed suit and been awarded damages because the process wasn't right."

Many investigators come to the corporate world from a career in law enforcement. This affords them an extensive knowledge of investigative techniques but little experience in navigating the rocky shoals of corporate politics. Many corporate investigations are hobbled before they even start because security takes an overly aggressive posture within the organization. Not only does this expose the company to liability, it also discourages would-be whistle-blowers and witnesses from coming forward and sharing what they know.

Most frauds are reported by other employees, says Carl Pergola, national director of FirstGlobal Investigations, a division of BDO Seidman. Pergola says that "if you approach employees with a condescending or intimidating style, your first line of defence is unavailable to you."

"Besides," Pergola adds, "there's always an opportunity to intimidate someone [later] if you need to."

Diverse Experiences Wanted

Outside of Sherlock Holmes' lair at 221B Baker St, it's practically impossible to find a single individual who possesses all the skills that many corporate investigations will require. The best approach is to build a team of investigators with a broad spectrum of talents and experiences.

Many companies hire ex-law enforcement officers for their years of investigative experience. These individuals are often experts in interview techniques (see "Inside the Interview Room," below) and in documenting and tracking a case's progress. Many companies also round out their investigative unit with experts in computer forensics who can locate and preserve evidence that exists within a computer or the corporate network. They also look for forensic accountants who have a keen understanding of accounting principles and the particular business processes of their employer so that they can recognize irregularities.

At Boise Cascade, CSO Jim Ashby recalls one situation where ghost employees at several branch offices were entered into the payroll system at the paper and construction product maker. The person responsible for the fraudulent payroll records collected more than $US250,000.

During the early stages of an in-house investigation, the diversion of money hadn't seemed possible because there was traditionally a separation of duties between the person who created new employee records in the payroll system and the individual who sent staffing reports to each location. But after the diversion of money had gone on for some time, Boise Cascade investigators finally figured out that one person had changed jobs several times but had retained the ability to create and edit new employee entries, and had later deleted the "ghosts" before any reports could alert management. Although the perpetrator and spouse had already spent much of their ill-gotten gains prior to being brought to court, the judge ordered restitution, and the pair pleaded guilty to federal charges and were sentenced to multiple years in prison, Ashby says.

While Ashby's team had the skills to solve that case, some companies may wish to outsource some or all of their investigations to a vendor that has the full range of capabilities instead of building their own unit. This is especially critical for companies that routinely deal with investigations that are international in reach. The cultural issues and conflicting legal systems that come into play when dealing with an employee or business partner based outside the United States can flummox even the most seasoned investigator.

Prior to joining Kimberly-Clark, where he is a senior regional security manager, John Rodriguez worked as an independent consultant and participated in more than 200 investigations in Latin America. Rodriguez suggests looking for an investigator who possesses cultural sensitivity. He points out that in some Latin American countries, the simple act of interviewing a subject in a closed room could be viewed as illegal detention or kidnapping. In some pro-labour countries, employees have a lesser threshold of proof for defamation or wrongful-termination. A skilled interviewer can neutralize such risks, Rodriguez says.

Whether you choose to use an internal or external investigator, Rodriguez suggests focusing on one "who has the right skill set for that country, and a holistic understanding and experience of the country and the region that he is going into."

Those Intangible Qualities

In addition to learned skills, a crack investigator possesses some intangible qualities. The first is objectivity. This is especially important in corporate life, where investigations can reach up into the executive suite or down among friends and coworkers. Part of remaining objective is ensuring that the scope of your investigation isn't narrowed prematurely. Often the real problem will turn out to be something different from what was originally suspected or the first report will be just the tip of a larger concern.

"We investigated an incident where a worker in a manufacturing plant finally came forward [after months of intimidation] when a coworker threatened to kill him," says Tim Dimoff, CEO and president of SACS Consulting. "After some investigation, it turned out that four more people had been threatened by that same individual in the past six months." Dimoff says his company posted an armed security guard to protect fearful employees, then notified the worker making the threats about the investigation; the worker left soon after and found another job.

Second, investigators require an inquisitive mind. "Some people are better wired for this than others," says Fabian Campion, manager of business risk mitigation and investigations at 3M. "An inquisitive mind means not taking things at face value, not taking 'no' for an answer and constantly asking why." Investigators also have to be able to deal with the potential consequences of their job. "I've worked with some folks who have such good analytical skills," says Boise's Ashby, "but they can't deal with being the person who causes someone to lose their job or be disciplined. They can't ask questions knowing that they're going to get someone in trouble. Not everyone is cut out for this."

Communication skills are also a critical capability for investigators. They have to be able to view a case through a big-picture lens and with an attention to detail, and they must be able to present and encapsulate their findings to an executive audience or in court if necessary. This requires excellent verbal and written skills combined with good interpersonal skills. "You have to be able to not only articulate findings and explain what you've discovered," says Nihill, "but you have to talk to people involved in the organization, establish a relationship and promote a good exchange of information."

Building the Right Kind of In-House Support

A corporate investigative unit has four critical partners in an investigation: human resources, general counsel, internal audit and the manager of the business involved in the investigation. Building constructive relationships with each of these groups should be one of security's key goals. However, it's not always easy. Selecting what information to share and when to share it is an ongoing challenge. "The hardest thing we balance is determining who needs to know and how we help them understand that they can't share that information without jeopardizing the investigation," says Ashby. Several CSOs we spoke with recounted cases where they have informed human resources of an impending employee interview only to have HR notify the employee. In retrospect, most security executives admit that this was caused by a lack of communication. Campion says, "You can get too used to how you do [things] and assume other people have the same knowledge, but when you set your expectations up front, nobody spills the beans."

A similar problem often occurs when security informs a business unit manager that an employee or transaction involving his group is under investigation. Often that manager cannot resist doing a little Miss Marple-ing of his own and unwittingly tips off the people involved. It is a delicate balancing act. Sharing too little information will lead to inevitable criticism from the business, while too much can blow the investigation.

Investigators can manage this best by including managers and human resources in the process, giving them as much information as is practical, explaining how they can help and the importance of confidentiality in preserving the investigation. For example, in a sexual harassment case, security might wish to notify a manager that an allegation has been made of some inappropriate behaviour in his department and that they will be conducting interviews. Security might choose to withhold the identities of the accusers and the accused to prevent any awkwardness or unsolicited sleuthing.

Involving legal early and often is also a good rule of thumb. "Our policy, by default, is to have everything covered under attorney-client privilege, wherever permissible, so that we can preserve our discretion on how to proceed," says Denis Verdon, senior vice president and head of the corporate information security group at Fidelity National Financial. Verdon adds that keeping knowledge of investigations on a strict need-to-know basis is critical. "If information regarding an investigation is inappropriately divulged, this may in some cases compromise client-attorney privilege and may become discoverable," he says. Fidelity National is a speciality insurance provider and is the nation's largest real estate title insurer.

In addition to those protections, a contact in the legal department should be involved in cases that include the potential for termination, to prevent creating additional legal exposure. General counsel should also be brought in early on any case where disclosure of an incident to police or government regulators could be mandated by law.

Recognizing what these other functions bring to an investigation and adhering to strict boundary limits in security's role are critical to building a strong investigative capability. "Corporate security is an independent group. That's what makes us good investigators," says Campion. "HR tends to be viewed as employee advocates, and legal is concerned with risk. We're not out to get employees, but we're not their advocates either. We weigh in as an equal partner at the table, but the decision of whether somebody is hired or fired is not made by corporate security."

Though security should not make any punitive decisions, they can be instrumental in preventing one of the frequent pitfalls of an investigation: unequal treatment. At Boise Cascade, Ashby stresses the importance of having senior management and counsel sit down and work out what the policy of the corporation will be toward different infractions so that security can approach each case in a uniform manner. "I strive to make sure that we don't fall into the trap of every case being treated differently based on how well management likes or doesn't like that employee," says Ashby. "It's difficult to get everybody on board, but there has to be a definitive agreement that this will be the criteria [for prosecution or dismissal], and it doesn't matter who you are."

Develop a Flexible Process

The CSO's role in an investigation is to be the navigator. He sets the direction that the investigators should follow and checks in frequently to recheck their course. The first 24 to 48 hours of a case are critical, and in order to hit the ground running, the investigative team needs a process that is rigorous enough to make maximum use of that early window but flexible enough to ensure that the investigation is not unduly restricted. The first few days of an investigation are especially important in cases where law enforcement or a regulatory agency is likely to get involved. "Once you go to the US attorney or a regulatory agency, that limits what you can do on your own," says Nihill. "If somebody embezzled money or has gotten kickbacks from contracts, you should do as much as you can before the perp can get counsel. A lawyer won't let them talk, but [if you get to them early] you might get a confession."

The CSO and lead investigator should meet early to outline a game plan for the investigation. This will include a discussion of the resources - both technical and manpower - that the investigation will likely require and some initial goals. "We talk about what we have and where we think this is going to take us," says Campion. "Even if it's a small case, we lay down those road markers." At 3M, the investigative unit has also found that by reaching out to the business unit early, it buys them goodwill and assistance when they need it. "It's best to meet or communicate with that division's vice president because not only can we get additional perspective, it buys corporate security the support it needs to do its job. So we're never in the position of being the snoopers."

As an investigation unfolds, the lead investigator should report to security executives at frequent intervals to assess their progress and refocus and amend the operation if necessary. At 3M, the investigative unit has a process called case review. Every other week the investigative teams gather around a table for an hour to discuss the cases they're working on. "This is not to show how busy we all are," says Campion. "It's a chance to throw out what we're working on, leverage the talent and expertise of the team, and draw out some new ideas and approaches."

After an investigation is concluded, it's also important to ensure that the business leaders involved are apprised of the findings so that they don't come back six months later wondering what happened to the investigation. This is an area where many investigative teams lose a lot of goodwill. At 3M, investigators typically wrap up each case with a formal findings meeting. They also cherry-pick their biggest cases and every quarter issue a report to senior management that includes a short paragraph about each case and what's been done to resolve it.

Whether a company decides to go public with the results of an investigation is another matter. The CSO and senior management have to weigh the potential downside of pressing charges: the expense and, in some cases, the potential damage to the company's reputation. But there are often benefits. If money was stolen, for example, restitution might be a possibility. Elaine Wood, a managing director with Kroll, recently led a forensic audit to trace $US13 million that had been stolen by an employee of a New York money management firm. The company was able to recover more than $US5 million in assets. Going public can also discourage other would-be offenders from attempting the same crime. However, sometimes the only benefit is to the public good, and even that is no small thing.

A few years ago, Marquet worked on a case where he was tasked with vetting a CFO candidate for a public company. In investigating his background, Marquet discovered that a previous employer had fired him for misappropriating corporate funds. Because the previous employer had brought civil charges, Marquet was able to find out what had happened and prevent his client from making a potentially disastrous mistake. "I think it's incumbent on companies to go after individuals who do [such] acts and bring it to light," says Marquet, "so that they won't get into a position of trust again."

SIDEBAR: Inside the Interview Room

Learn to separate truth-tellers from fiction-spinners

Every person coming into an investigator's interview is already fearful, says Nate Gordon, director and founder of The Academy for Scientific Investigative Training in Philadelphia. When an interviewer presents himself professionally and behaves in a calm, authoritative manner, a questioning session separates the innocent from the guilty. The innocent person becomes less fearful, and the guilty person's anxiety increases. Gordon, who teaches courses on interview techniques, says experienced questioners use many tools to be effective. Among them:

Icebreakers. An interview usually starts with some icebreaking chitchat unrelated to the investigation. This allows the interviewer to get a sense of the subject's style: things like verbal tics, amount of eye contact and physical mannerisms.

Non-verbal cues. When discussing the case, the interviewer looks for non-verbal behaviours. A deceptive person will often put a hand to his eyes or mouth to obscure what he's saying. A truthful person usually exhibits mannerisms that clarify what he's saying, like touching a hand to his chest and making eye contact when stating his innocence.

Set up two chairs. Gordon recommends placing two chairs facing each other so that the interviewer can see the subject's entire body and there's no object behind which a subject may hide.

Consistent questions. With multiple subjects, the interviewer should avoid accusatory questions and ask each one the same set of questions, and should use a consistent reading and writing style. The questions should either be all read off paper or all memorized. Every response by the subject should be written down. (Selective recording invites a subject to analyze the interviewer's behaviour.)

Anyone else in the room must be silent. If a manager or an HR representative is present, that person should sit behind the subject and stay quiet. "I tell them they can sit in under one condition," says Gordon. "If they think I've asked an improper question, they should say, 'Mr. Gordon, can we step outside?'" Other than that, they have no input." - Daintry Duffy

SIDEBAR: Scenes to Investigate

The following is a selection of groups that offer conferences, information-sharing and training for investigators

The High Technology Crime Investigation Association
A professional association for investigators using information technologies. Its newsletter includes tips on computer forensics and other investigative techniques.

International Association of Financial Crimes Investigators
A professional group formed in 1968 that provides training for investigators fighting financial fraud.

The Government Accountability Office
Publishes an online "Investigators Guide to Sources of Information" as a tool for finding information about people, property, business, and finance.

The California Financial Crimes Investigators Association
Established in 1951, is a group of investigators from both the public and private sectors who pursue financial crimes. The group holds an annual training conference in the state.

Join the newsletter!


Sign up to gain exclusive access to email subscriptions, event invitations, competitions, giveaways, and much more.

Membership is free, and your security and privacy remain protected. View our privacy policy before signing up.

Error: Please check your email address.
Follow our new CSO Australia LinkedIn
Follow our new social and we'll keep you in the loop for exclusive events and all things security!
Have an opinion on security? Want to have your articles published on CSO? Please contact CSO Content Manager for our guidelines.

More about 3M AustraliaACTCherryFidelity NationalHISING AustraliaIRSIRSKimberly-Clark AustraliaKrollProcter & Gamble Australia

Show Comments

Featured Whitepapers

Editor's Recommendations

Brand Page

Stories by Daintry Duffy

Latest Videos

More videos

Blog Posts