By Christina Nichols, MBA, CAE

 In 2005, Association™ magazine published an article on embezzlement.  In it, three association executives, anonymously, set out how they were victimized.  Sadly, the not-for-profit sector, just like others, continues to be victimized by employees.  You might file this article for future reference should you ever find yourself facing this difficult and challenging circumstance.

Have you found one or more odd charges on your bank statements?  A new (unknown) vendor perhaps?   Is the petty cash being replenished more often than usual?   What should you do?  Document!  Document!  Document!

What concern do you have? 

Clearly document what you have discovered that makes you uncomfortable – when you noticed it (day and time), who was with you when it was discovered, and who you suspect might be involved. 

Then set out the steps you took in response.   What action did you take?  What were the results?  Document the date, the time, and the names of those present and what was said.  Clearly document the nature of the evidence you uncovered.  Repeat as necessary.

These details will become important to you, your auditor and your legal counsel if your concerns are well- founded and civil or criminal investigations are undertaken.  They may also serve to protect you and your organization from a defamation suit or counter legal action.

There is no ideal list of approaches and steps to take when fraud is suspected but consider drafting a set of procedures you might use to evaluate the legitimacy of a concern.  

Keep in mind that more often than not, what you may initially suspect and discover may only be the tip of the iceberg.  Where there’s one transaction there’s likely to be others: many others.  Each situation will be different and your actions will need to be carefully yet confidently executed.  You will need to consider your internal controls, banking procedures and segregation of duties.  Where are the possible weaknesses?

Secure the premises.  Do you have a sense of who is involved?  Minimize the involvement of other staff or volunteers during your investigation.   Is there one staff person or colleague who can assist you as you undertake the steps necessary to secure your organization’s assets from further loss?  This person may also serve as support and a witness to any actions you take or discoveries.

Follow the same protocol you would use for dismissing an employee.  Is it the morning or end of the day?  Has your staff left for the day?   You will need to consider these and other factors in how you secure your office premises.  If you have reason to be concerned for the safety of your team or yourself, involve a private security company before asking the employee(s) to vacate the premises.  Do not leave any suspicious person unattended at their desk or in their office.  Prevent computer access.  Do not allow files, papers or equipment to be removed from the premises.  Likewise, do not allow the person under suspicion an opportunity to re-enter the premises after hours.   Personal property can be returned  later.   Ask for the return of all keys or access cards for the duration of your investigation.  

Secure the evidence.   Where might the evidence be located?   Are all keys accounted for or should you change the locks?    Change computer, email, online forum, remote desktop and network passwords within moments of the dismissal.  Change phone passwords as soon as possible.  Modify alarm codes and notify the alarm monitoring company before you leave the premises.  

Once the person(s) have been removed from the premises, minimize the shock effect to other staff.  Meet with your team.  Keep details to a minimum - do not engage in discussion regarding suspicions or transactional details.  Protect confidentiality and the rights of the person(s) being investigated.  Secure a commitment of non-disclosure from your staff.  Be reassuring and confident.  Advise your staff that there is an internal investigation and outline the short term impact (i.e. what will be expected of them over the next 48-hours and the anticipated operational impact).

Protect the organization from the potential of additional losses.  Contact bank, credit card and other credit suppliers.  Ask your banking officer to temporarily freeze your organization’s accounts and manually process all transactions.   You may need to change banking authorities and/or contact information until an investigation has been completed.  Verify and secure your cheque supply.  Are there some missing?   Is there electronic banking access that should be cancelled? Are there any very recent transactions that can be immediately reversed by the bank to minimize your losses?  Are there any recent credit card transactions that might be reversed?  Do you have a payroll or investment service? Are there other creditors or suppliers that should be contacted immediately and administrative rights or authority removed?   Verify insurance coverage for employee dishonesty.

Preliminary assessment.  Begin investigating and document what you find.  Have you noticed any payment patterns?  Any late payment notices?  Repeating numbers and intervals? Verify that accounts payable and receivable files are complete – is there missing documentation?  Review your general ledger and vendor listing.  Review all bank reconciliations and cancelled cheques.  Verify electronic payment history.  Verify email transfers, deleted email folder and sent email folders.  Review your inventory. Review all payroll records and mandatory remittance statements.  Verify your tax accounts and filings. 

Communication.  Contact the Treasurer and Chair of your Board of Directors.  Once the organization’s assets have been secured and you have some understanding of the issues, brief your Chair and Treasurer about the situation - inform them of the steps you’ve taken and the steps you will take within the next 24 and 48 hours. 

Prepare your statement.  Draft your statement of facts that may be used by your lawyer and the authorities.  Outline the facts chronologically, include complete dates, times and discussions.  Supporting documents should be photocopied, attached and referenced.  

Contact your legal counsel.   Present your preliminary findings.  Ask for advice.  Do you have knowledge of assets or funds that may be frozen for eventual recovery of the associations assets?  Discuss civil and criminal options.

Contact your auditor. Present your preliminary findings and make arrangements for further investigation.  Your auditor may undertake the work or refer you to a fraud investigator.

Brief your Board of Directors.  Discuss the discovery and the steps taken.  Recommend communication strategies for your membership, stakeholders and partners, the public, the media and any group which may be affected or concerned by the loss. 

Protect the integrity of the evidence.  Ask your legal counsel for advice. Keep all documents and any information related to the investigation locked in a cabinet that only you will have access to.  Ensure that your legal counsel has a certified copy of any evidence or information that might be needed for criminal, civil litigation or recovery purposes.

Communication:  Be open, clear and concise in your messages.   Communication during a crisis is sensitive.  Don’t be afraid to ask for help.   Have your legal counsel review all messages to protect you and your organization from a potential defamation suit.