No organization is immune to the risk of occupational fraud. According to the Association of Certified Fraud Examiner’s 2024 Report to the Nations, organizations lose approximately 5% of revenue to fraud each year with a median loss of $145,000. Discovering that a trusted employee (or business partner) has been stealing from the company can be overwhelming to owners and there may be confusion as to what to do next.
Following the steps below can protect your company and help you make the best decision when a theft occurs.
It’s important to act quickly and notify in-house counsel (or human resources if you don’t have in-house counsel) regarding your suspicions, however, they must be based upon rational reasoning. Examples of “red flags” to look for include: the employee is refusing to give you or others financial information, unexplained changes in the company’s cashflow, irregular accounting entries, the company receives vendor and/or customer complaints, employees not wanting to go on vacation, and employee life-style changes. Additionally, companies should investigate any tips and/or whistleblower complaints that come in from other employees.
Investigating the theft and the suspicious employee is necessary to determine the potential damage to the company. But first, one must establish a team of professionals such as an outside general counsel, a forensic accountant, and in some cases a computer specialist who would be needed to preserve evidence. If the suspected employee is still working at the company, ensure they no longer have physical, electronic access, or financial access to the company’s assets.
Working simultaneously with in-house counsel and other accounting staff in a discreet manner can be very helpful in building evidence for your investigation. If the suspicious employee’s access has been cut off and questions management about this, it is important to remain discreet. One can do so by explaining to the employee that the organization is improving best practices within the company by not having one person with full control of many responsibilities.
A suspicious employee who has access to many different accounting functions may be embezzling in multiple ways especially if there are no segregation of duties and/or poor internal controls within the finance and/or accounting divisions of the organization.
Essentially, everything the employee had access to should be investigated. Depending on the circumstances, the employee may not need to be terminated immediately as their cooperation could be helpful in the investigation.
It’s important to conduct internal investigations with minimal errors. The most fundamental error is not conducting any investigation at all. Employees and/or anonymous tips brought to an organization’s attention should be investigated and by failing to do this, businesses are at risk of a possible lawsuit, and depending on the situation, potential criminal charges. Often businesses refrain from conducting investigations due to the expense and time involved.
Another common mistake businesses make is waiting too long to start an investigation. It’s important to determine early on who will conduct the investigation and to whom the investigating team reports. The investigation team should not report to someone who may have done something wrong in connection with what is being investi-gated. This can be avoided by reporting directly to the Board of Directors.
It’s imperative when investigating to document all steps to show that the investigation was conducted in an unbiased manner and was detailed and proper. One should review relevant evidence rather than relying solely on employee interviews.
Often times investigative reports can be used for internal purposes. However, sometimes reports will be shared with others such as assistant district attorneys, other government agencies, and/or investors. It’s critical to work with outside counsel in generating reports that are independent and reflect that a thorough investigation was conducted.
Once a forensic accountant completes the investigation, the suspicious employee can be interviewed and questioned using evidence obtained from the investigation. The interview should be conducted in a fair and neutral manner with outside counsel present, and the suspicious employee should be given a chance to explain his or her actions.
The employer should consult with counsel to determine next actions to take against the employee. This could involve either suing the employee, reporting that person to law enforcement, or contacting the company’s insurance carrier as the company’s insurance policy may cover employee dishonesty.
Reporting your findings to law enforcement can (in some instances) be beneficial. Criminal investigators may be able to obtain information through a subpoena that the company cannot. Other employees who are aware of the employee dishonesty may be more cooperative with law enforcement rather than with the company. In addition, if the investigation results in a conviction, you may be able to file a request for restitution.
On the other hand, often, going to law enforcement may not be the best option as there may be a risk of reputational harm to the company. If a company decides to pursue a civil action against the employee to collect the amount embezzled, you need to keep in mind whether the employee has the ability to reimburse the company for any part of the theft. Ultimately, the company may decide to terminate the employee and file a claim with their insurance carrier to try and recoup the loss if they have fidelity or commercial crime insurance.
Depending on whether the company’s insurance policy has this type of coverage, you will need to contact your insurance provider within a couple of months of discovering the employee theft to initiate a claim. Keep in mind that you will need to file a proof of loss and provide supporting documents within a specified time period as described in your insurance policy. The proof of loss is a sworn statement that often is notarized and details the incident and the amount claimed.
Some insurance policies may even cover the cost associated with developing the proof of loss statement. The proof of loss typically includes details of how the theft occurred, supporting documentation, and a quantification of the amounts embezzled. Forensic accountants can also quantify the theft and provide support for the insurance claim.
Examples of the types of supporting information you may want to gather include financial records such as bank statements and cancelled checks, credit card statements, witness statements, employee interviews, and surveillance footage.
For more complex insurance claims, forensic accountants are often hired to examine the claim, both by the insured or for the insurer. Forensic accountants can evaluate the evidence surrounding the claim, identify the responsible parties, and conduct interviews of key personnel.
Interviewing other employees who may be knowledgeable about the wrongdoing can be very helpful in narrowing down areas to investigate. Forensic accountants can also assist with the possible recovery of stolen assets from the company.
Insurance companies often require companies to mitigate any future losses once the embezzlement or dishonest activity is discovered. Forensic accountants and other professionals can assist in evaluating a company’s internal controls and can make recommendations for improvement in specific areas.
Companies are often asked by the insurance carrier about what changes they made to their internal controls in response to the theft as a way of determining whether to continue the coverage. There are steps that every company can take to reduce the likelihood of workplace theft. Some examples include having more than one employee approve financial and/or accounting transactions, ensuring no single person has control over an entire process, conducting random internal and external audits, having all employees sign an anti-theft policy, having a whistleblower hotline, and reviewing and updating controls regularly to ensure they remain effective and address new risks.
Discovering that an employee (or business partner) has embezzled from the company does not have to be intimidating. There are steps you can take to determine the best course of action against the dishonest employee.
Establishing the right team to investigate the harmful act is just as important as conducting a discreet investigation that can minimize the effect of your business operations and reputation. Business owners often need help in determining whether their company has the necessary structure, controls, and tools to prevent the next fraud. Enlisting the company’s technology personnel, legal counsel, and forensic accountants quickly to assess the extent of the damage is crucial or you may face the risk of a possible lawsuit and/or criminal charges.
Beyond the immediate response, organizations must take the time to understand both how and why fraud occurred in the first place, review internal processes, find gaps in segregation of duties, and evaluate whether proper oversight systems were in place. A thorough post-incident assessment allows leadership to strengthen internal policies and reinforce accountability at all levels of the company.
Experienced forensic professionals can provide recommendations for improving processes, clarity on the order of events, methods that were used to conceal the fraud, and a quantification of the financial implications the fraud had on the business.
Additionally, maintaining transparent communication with both your internal stakeholders and, when appropriate, external partners, helps maintain trust during this time. While confidentiality is vital, ensuring that employees understand the company’s commitment to ethical behavior and security can deter future misconduct.
Ultimately, addressing embezzlement swiftly, thoughtfully, and with the guidance and support of qualified professionals, empowers organizations to protect their assets while rebuilding confidence and emerging stronger.
Sareena Sawhney is a partner of the Valuation, Forensic Accounting and Litigation support team of BST & Co.
Reprinted with permission from the 12/29/2025 edition of the “NEW YORK LAW JOURNAL” © 2025 ALM Global Properties, LLC. All rights reserved. Further duplication without permission is prohibited, contact 877-256-2472 or asset-and-logo-licensing@alm.com.
