Phase 1 — Receiving and Assessing the Allegation
Every investigation begins with an allegation — from a whistleblower, an audit exception, a manager's observation, or an external complaint. The first step is assessing whether the allegation warrants investigation and, if so, at what scope and urgency.
- Allegation assessment criteria: Specificity (named individuals, amounts, methods), corroboration (is there any supporting evidence?), materiality (what is the potential loss?), and urgency (is the fraud ongoing?)
- Preliminary enquiry: A brief, low-profile initial review of readily available records to establish whether the allegation has sufficient basis to proceed to a full investigation — without alerting potential suspects
- Management notification: Determine who within management should be informed at this stage — avoiding notification to anyone who may be implicated
Phase 2 — Investigation Planning
A documented investigation plan must be prepared and approved before substantive work begins. This plan protects the investigator and the organization, and demonstrates professional methodology to any subsequent reviewer.
- Defined investigation scope and objectives
- Identified potential evidence sources
- Planned analysis procedures
- Anticipated interview sequence and methodology
- Defined reporting structure and timeline
- Legal counsel engagement — especially for matters likely to result in prosecution or civil action
Phase 3 — Evidence Gathering and Analysis
The investigative core — systematic collection and analysis of all relevant evidence before any suspect interview.
- Documentary evidence: Financial records, contracts, correspondence, approvals, and policies relevant to the alleged scheme
- Digital evidence: Email records, system access logs, transaction history, deleted files — all collected forensically
- Third-party records: Bank records, vendor records, public registries — obtained through voluntary disclosure or, where necessary, legal process
- Transaction analysis: Mapping all financial movements related to the allegation — creating a complete financial picture before speaking to any person
Phase 4 — The PEACE Interview Model
The PEACE model is an internationally adopted, ethically grounded interview framework that focuses on obtaining accurate and complete information — rather than obtaining a confession through pressure.
| PEACE Element | Purpose | Key Activities |
|---|---|---|
| Preparation | Know your evidence; plan your approach | Review all evidence; prepare open questions; plan logistics |
| Engage & Explain | Establish rapport; set the tone | Introduce purpose; explain the process; build initial rapport |
| Account | Obtain the subject's full account | Open narrative first; then structured questioning; then challenge |
| Closure | End professionally; leave options open | Summarize; invite additions; explain next steps |
| Evaluation | Assess the account against evidence | Compare interview content with documentary evidence; identify inconsistencies |
Phase 5 — Conclusion and Reporting
Investigation conclusions must be based on the balance of probabilities (civil standard) or beyond reasonable doubt (criminal standard), depending on the intended use of the report.
- Every conclusion must be tied to specific evidence — no unsupported assertions
- Alternative explanations for evidence must be considered and addressed
- The investigation report must be written as if it will be read by a court — because it may be
- Recommendations for control remediation should accompany every substantiated finding
Key Takeaway
A fraud investigation is only as strong as its weakest procedural step. Organizations that invest in structured investigation methodology — planning, evidence-first sequencing, PEACE model interviews, and court-ready reporting — consistently achieve outcomes: recovered assets, successful prosecutions, and strengthened controls. Organizations that improvise achieve outcomes too — just not the right ones.
Read: Interview & Interrogation Methods →