Where money is involved.
WHAT TO ESTABLISH
What is suspected What evidence exists What period is involved What systems hold relevant records
WHAT RECORDS TYPICALLY MATTER
Accounting entries and their history Payment records Supplier and customer records Approval records Email and communications System access records
WHY ENTRY HISTORY SPECIFICALLY
Changes to records are frequently more revealing than the records themselves.
WHAT TO PRESERVE
The accounting system data, before anything is altered.
WHY
Continued operation changes it.
WHAT TO ESTABLISH ABOUT ACCESS
Who could have made the entries.
WHAT TO EXAMINE
Whether the person had access Whether others did Whether credentials were shared
WHY
Access alone does not establish who acted.
WHAT TO LOOK FOR
Transactions outside normal patterns Entries made outside normal hours Payments to unfamiliar parties Round numbers Amounts below approval thresholds Reversals and corrections
WHAT TO RECONCILE
Records against independent sources: bank statements, supplier statements, physical stock.
WHY INDEPENDENT
Internal records may have been altered; external ones are harder to change.
WHAT TO DO ABOUT SUSPICION OF A SPECIFIC PERSON
Do not confront before preserving evidence.
WHY
Evidence is destroyed and the opportunity is lost.
WHAT TO ESTABLISH
Whether to restrict their access, and how to do so without alerting them prematurely.
WHAT TO CONSIDER
Whether the matter must be reported.
WHAT TO OBTAIN
Legal advice, early.
