Employee Fraud: Detection, Investigation and Response ACFE – Toronto Chapter March 5, 2013

1. Employee Fraud:Detection, Investigation and ResponseACFE – Toronto ChapterMarch 5, 2013 Denise L. Bambrough - Fraud Law Group dbambrough@blg.com Elissa Sinha – Fraud Law Group esinha@blg.com www.blg.com Twitter: @BLGLaw

2. Agenda • Identifying employee fraud • Why the conduct of an employee fraud investigation is so important • Investigating allegations of employee fraud • Meeting with the suspect employee • Mitigation and recovery of damages

3. What is Fraud? “[a] generic term embracing all multifarious means which human ingenuity can devise, and which are resorted to by one individual to get advantage over another by false suggestions or by suppression of truth, and includes all surprise, trick, cunning, dissembling, and any unfair way by which another is cheated.” Black's Law Dictionary, 6th ed., s.v. “Fraud”

4. Identifying Employee Fraud • When does fraud occur? • Motive • Opportunity • Rationalization • Most fraudsters are influenced by a combination of opportunity, quantum at issue and risk of detection

5. Identifying Employee Fraud “Report to the Nations on Occupational Fraud and Abuse – 2012 Global Fraud Study” Associationof Certified Fraud Examiners

6. Common Employee Fraud Schemes • Embezzlement • Fictitious vendor/invoice schemes • Secret commissions and kickbacks • Expense report fraud • Financial statement fraud • Payroll fraud – phantom employees • Cheque fraud • Inventory and asset misappropriation

7. Employee Fraud – Red Flags • Be alert to changes in the behaviour, attitudes and lifestyles of employees • Possible red flags include: • Living beyond apparent means • Financial difficulties • Unusually close association with vendors or customers • Severe stress • Alcohol or drug abuse • Gambling • Extreme nervousness • Dissatisfaction with salary or position

8. Employee Fraud – Red Flags (continued) • Reluctant to take vacations or be absent for any reason • Works significant amounts of overtime, without seeking compensation • Offers gifts to encourage others to turn a blind eye • Excessively angry, defensive or forgetful when asked about business processes, procedures and decisions • Lies about business-related matters • Expense account is heavily used in comparison to employees with similar responsibilities

9. Why The Conduct of An Employee Fraud Investigation is so Important • Defrauding one’s employer is just cause for dismissal • However, where theft or other fraudulent conduct is the reason for dismissal, a more exacting standard of proof is imposed upon the employer • Meeting this standard requires a “fair and diligent” investigation of the alleged conduct

10. Why The Conduct Of An Employee Fraud Investigation Is So Important • Even the most serious and seemingly obvious cases of employee fraud must be investigated with great care, an open mind and fairness to the suspect employee • An incompetent investigation may: • Fail to establish fraud as just cause for dismissal • Expose the employer to possible claims for:

11. Investigating Allegations of Employee Fraud • Always keep an open mind • The only one who knows all of the facts is the fraudster and there may be more than one • False accusations can be costly! • Secure and preserve the evidence • Be discreet • Reputations are at risk • Consult experts – lawyers, accountants, computer forensics experts, private investigators at an early stage

12. Investigating Allegations of Employee Fraud • Protect against further loss • Identify all security concerns with respect to the suspect employee(s), including: • keys to premises • pass cards to premises • passwords to network system • voice mail • e-mail • data stored on laptops

13. Investigating Allegations of Employee Fraud • data stored on home computers • data stored on mobile devices • files or records at employee’s home office • access rights from external computers • banking arrangements • dealings with outside suppliers • and any other source of vulnerability between the suspect employee(s) and the company

14. Meeting with Suspect Employee • Rights of the parties: • An employer has the right to conduct an interview • An employee does not have the right to refuse an interview • No right to counsel • No right against self-incrimination • Caution - R. v. Reid - [2000] N.J. No. 210 (Nfld.S.C.T.D.)

15. Pre-Meeting Preparation • Secure personnel file of suspect employee(s) • Secure company documents relevant to the investigation • Secure/image computers and electronic records, if policy clearly provides for same. • Ensure that the investigation is conducted on a “need to know” basis involving only those senior management persons with information concerning the investigation • If the employee is a member of a union, review the collective agreement for any rights or requirement to have a union representative in attendance at the meeting*

16. Pre-Meeting Preparation • Be prepared – know all of the facts; know how the system works • Organize all relevant documents for interview of suspect employee(s) • Prepare outline of known facts for review with suspect employee(s) • Consider potential reaction of employee(s) (both employee under investigation and other staff) and determine whether counseling for employee(s) should be offered

17. Pre-Meeting Preparation • Consider whether the suspected employee fraud triggers fidelity insurance coverage or a duty to give notice to fidelity insurer or regulatory authorities and, if so, take appropriate steps to give notice* • Consider taking preliminary steps such as commencing legal proceedings to secure any employee or third party assets prior to confronting employee(s)*

18. Employer’s Right to Investigate vs. Employee’s Right to Privacy • Many workplace investigations give rise to issues involving the respective rights of the employer and the employee relating to the use of workplace technology • An employer has a legitimate interest in the conduct and activities of its employees in the workplace • Employees, on the other hand, have certain rights of privacy • These interests have to be balanced

19. Employer’s Right to Investigate vs. Employee’s Right to Privacy • Distinction between test for exclusion of evidence in criminal cases vs. civil cases • Canadian Charter of Rights and Freedoms values may guide judiciary in civil cases • The Ontario Court of Appeal has recently recognized a common law tort of invasion of privacy or “intrusion upon seclusion” • Recent Court decisions highlight the need for clear policies

20. Employer’s Right to Investigate vs. Employee’s Right to Privacy • Ensure that you have clear and unambiguous information technology and privacy policies with respect to personal use and storage of information on work computers • Stipulate that the hardware and all information thereupon belong to the employer and can be accessed and verified at all times • Ensure that the policy is known and enforced • Notify employees that information obtained during monitoring may be turned over to the police if the commission of a crime is suspected

21. Employer’s Right to Investigate vs. Employee’s Right to Privacy • Case acknowledges that employers may access data stored by employees on workplace computers, in appropriate circumstances • Before conducting a thorough search of an employee’s computer, ensure that there are serious reasons (supported by evidence) to do so • Police authorities need a warrant to access such information, even if the employer is entitled to access it • Verify with counsel before searching an employee’s computer, regardless of the circumstances

22. Meeting with Suspect Employee • Identify Interview team: • Person in charge of investigation • Senior management with responsibility for human resources • Union representative, if necessary or appropriate • Outside counsel or other consultants • Someone neutral to be a witness and take notes

23. Meeting with Suspect Employee • Decide who, where, when, with how much notice and for how long • Consider order of interviews to be conducted • Always conduct the interview in person • Interview as soon as practicable • Provide as little advance notice as possible • Assume that the first meeting will be the only meeting

24. Meeting with Suspect Employee • Conduct interview impartially and with an open mind • Request the employee’s explanation • Challenge the employee’s explanation using documents • Record verbatim legible notes • Include initial “chitchat”, observations, comments, long silences, description of body language • Tape record meeting only with knowledge and consent*

25. Meeting with Suspect Employee • Allow the employee time to become comfortable before making any accusations (i.e. “I understand that you have a lot of expertise/knowledge of this issue. I hope you can help me.”) • Maintain eye contact • Don’t let the suspect employee gain control of the interview • Don’t accept vague answers

26. Meeting with Suspect Employee • Don’t disclose all of the information which has been obtained • Don’t let the employee know where you are going with your questions • Don’t over-complicate the interview • Move quickly through the facts • Obtain a confession and a signed statement, if possible Have the employee review the notes/statement, initial every page and confirm accuracy

27. Meeting with Suspect Employee • Be fair: • Don’t treat different employees differently • If employee asks whether is subject of investigation, don’t mislead, but don’t suggest that conclusion has been drawn already (i.e. “Right now, we are looking into all of the facts before we can determine who is responsible. We will be interviewing several other people as well.”)

28. Meeting with Suspect Employee • If further investigation is warranted following meeting with suspect employee, temporary steps should be taken to preclude further access to company facilities by suspect employee while investigation is underway, including request for keys, pass cards, passwords, and any other security concerns as referenced above* • Consider whether appropriate to request that suspect employee access office computer and provide all passwords for access prior to departure*

29. Meeting with Suspect Employee • Consider whether appropriate to request hard drive dump of laptop or home computer and deletion of company files located on other computers* • Inform employee of duty to assist with ongoing investigation and confidentiality of the investigation • Consider whether appropriate to offer counseling to employee • If further investigation is warranted, consider suspending the employee either with or without pay pending completion of investigation*

30. Interaction With the Police • There is no legal obligation to report employee fraud to the police • But, is there a policy of reporting all criminal offences to the police? • An employer cannot offer to refrain from reporting fraud in exchange for restitution • An employer cannot threaten criminal charges in the absence of restitution

31. Interaction With the Police • An employer cannot simply rely upon criminal charges to justify discipline/dismissal • An employer is often in a better position to investigate: • Familiarity with employees • Familiarity with procedures • Employees/witnesses may be less intimidated and more frank • Resources • Control over investigation • Access to evidence • Access to witnesses • Action for malicious prosecution

32. Post-Meeting Action • Pursue any further investigation required, including interviewing additional employees, suppliers, customers and others who may have knowledge (Note: No allegations of dishonesty should be made about the employee at this stage) • Develop a communication plan - consider retaining a public relations firm to assist • Consider possible further interview of suspect employee prior to termination

33. Post-Meeting Action • Consider what, if any, disciplinary proceedings should be pursued: • Explanation accepted and no further disciplinary conduct warranted • Letter of warning • Written acknowledgement of wrongdoing by suspect employee with commitment to avoid such future conduct • Suspension with pay pending investigation* • Suspension without pay pending investigation* • Immediate dismissal

34. Post-Meeting Action • If employee is to be terminated: • Prepare a termination letter with the assistance of counsel • Prepare a “script” in advance of the termination meeting • Take detailed notes of the meeting • Take appropriate steps to permit employee to recover personal items and take inventory of work area • Draft internal announcement regarding the termination with input from legal counsel

35. Post-Meeting Action • Consider including arrangements for restitution in any termination agreement with employee • Any restitution agreement should be premised upon a representation and warranty by the employee as to the scope of the fraud • Obtain legal advice regarding the terms of any agreement, including any effect such an agreement may have on fidelity coverage

36. Post-Meeting Action • If decision is made not to terminate, seek legal advice regarding fidelity insurance coverage and issue of possible automatic termination of coverage for “dishonest employee”

37. Post-Meeting Action • If appropriate, consider terminating cheque signing authority and notifying suppliers and customers of termination • Consider conducting a review of company systems, including hiring, supervision, accounting, Internet access, banking, etc. to address possible shortcomings and prevent further similar losses • Consider purchasing fidelity insurance for coverage against future losses • Consider implementation of or improvements to Employee Fraud/Dishonesty Policy

38. Post-Meeting Action • Consider initiating legal proceedings against employee(s) and/or others for recovery of loss • Consider possibility of any extraordinary remedies which may be available: • Mareva Injunction • Anton Piller Order • Norwich Pharmacal Order

39. The Mareva Injunction • A Court Order which prevents a defendant from dissipating his or her assets prior to trial, including: • bank accounts • investment accounts • real property • motor vehicles • shares • offshore assets • other assets held directly or indirectly by the defendant

40. Ancillary Relief • Sworn affidavit as to assets (Disclosure Order) • Production of information and documentation in the possession of financial institutions • Production of documentation in the possession of the police • Restitution Order

41. Sources of Information • Police investigation • Information to Obtain Search Warrant • Access to Information Requests • Private investigators • Forensic accountants • Financial institutions • Other experts

42. Recovery Targets • Defaulter(s) • Co-conspirators and other parties to the fraud • Constructive trustees • Auditors • Financial institutions

43. The Anton Piller Order • Another pre-trial remedy • Obtained without notice to the defendant • Requires the defendant to grant the plaintiff’s representatives access to its premises for the purpose of searching for and preserving evidence of a specified class

44. The Norwich Pharmacal Order • An Order of the Court directed at third parties, which requires them to disclose information and documentation so that the plaintiff may: • obtain information which is necessary to identify wrongdoers • find and preserve evidence which may substantiate or support an action against either known or unknown wrongdoers, or even determine whether a cause of action exists • trace and preserve assets

45. Strategy for Recovery Steps • Consult experienced counsel at an early stage • Action plan • Importance of acting quickly • Preserve element of surprise • Cost/benefit analysis • Remedies can be cost-effective

46. 5123351v1 THANK YOU!