Guilt by Investigation and Other Pitfalls

By W. Steve Albrecht, Conan Albrecht, Chad Albrecht, and Timothy L. Williams, CPP

The CEO of a large corporation received an anonymous telephone call informing him of a problem in the purchasing department. The caller suggested that a buyer of uniforms for the company was directing all business to one vendor without considering other bids and contractors. The CEO immediately asked the security director to look into the matter. The security director, who had recently transferred from another department, had never encountered anything like this and wasn't sure what to do. Because she sensed that the issue was a priority for the CEO, she decided to investigate the situation quickly. Without hesitating, she called the suspected buyer on the telephone and asked if she could meet with him about a possible fraud she was investigating.

A few minutes later, she was sitting across the desk from the suspect. "Let me get right to the point," she said. "We received a telephone call this morning implicating you in a vendor fraud involving collusion. Is there anything you want to tell me about any fraud you might be committing before I have you handcuffed and arrested?" The suspect quickly took out a note pad and started writing down her questions and allegations. After finishing, he looked at the security director and responded, "If you want to talk to me, you will have to do it with my attorney present. In the meantime, I have nothing to tell you except that I don't appreciate you barging into my office and accusing me of a crime I didn't commit."

The company eventually identified the real culprit, fired her, and ceased doing business with the suspected vendor, but it paid for its initial missteps. By documenting the threats made against him, the falsely accused employee was able to threaten the company with retaliatory litigation. Realizing that proper investigation protocols weren't followed, the company agreed to transfer the employee. The employee eventually left the company with a generous severance package.

SECURITY DIRECTORS ARE often asked to be involved in investigations like the one just described. Such investigations, which probe what are collectively described here as "ethics violations," may arise from suspected drug dealing, safety violations, conflicts of interest, fraud, discrimination, harassment, or other incidents. Whatever the nature of the suspected activities, it is, of course, critical for the investigation to conform to corporate policy and the law. If the company uses poor investigative practices or does not exercise care, perpetrators may get more from a court judgment they receive after filing a lawsuit against the company than they could ever get illegally.

Six factors are critical to conducting a good investigation. They include: keeping management informed, being objective, exercising discretion in discussing investigations, independently corroborating the facts, using the right investigative tools, and avoiding ineffective, unproven, or illegal investigative techniques.

Management awareness.
It is typically inappropriate to conduct an investigation into alleged misconduct without the approval of management. Therefore, investigators should make sure that management and others with a need to know are aware of and agree to the investigation and the techniques employed. As simple as this sounds, security personnel, auditors, and other investigators sometimes scoff at the idea of having management as a client at all, believing instead that the "corporation" is their client. In some cases, almost no one is aware that an investigation is underway.

Involving management early ensures accountability for the investigation, thus helping the investigator gain credibility and protection from allegations of unsupervised, possibly inappropriate, actions. Investigations clearly benefit from positive relationships with managers who are organizationally above the subject of the investigation. If the security department is charged with conducting an investigation, the security manager should be responsible for ensuring that the investigation is conducted appropriately and that the appropriate management is informed.

The investigation process also proceeds much better when representatives from line management, human resources, legal, security, audit, and ethics departments work together to ensure that the investigation is conducted fairly and appropriately. This is not always possible, because some investigations must be conducted under a strict need-to-know basis through the corporation's lawyers. Nonetheless, engaging all of the relevant corporate functions, when possible, is the best way to ensure that any investigation considers all points of view.

Particularly important is making sure that legal issues are properly addressed, such as chain of custody and treatment of interviewees. Because fraud and other violations occur infrequently at the typical company, investigators should recognize that a supervising manager might lack experience in these matters. As a result, it is essential to include the general counsel of the business unit, along with an appropriate human resources representative, to provide as much help as possible. The roles and responsibilities of each functional representative involved should be clearly defined and agreed to at the initiation of every investigation.

The approach and demeanor of investigators is of critical importance to the successful outcome of the case. First and foremost, the investigator must project an air of objectivity. If investigators fail to exercise care in choosing words to describe the incident or fail to maintain a neutral perspective, their impartiality can immediately be called into question by management and employees.

In addition to projecting an outward appearance of objectivity, investigators must maintain the right internal perspective. They must not jump to conclusions--even in the face of what seems to be overwhelming and conclusive evidence--without first independently corroborating the facts. The failure to corroborate evidence is a common mistake of inexperienced investigators, but it can also happen with more experienced personnel when overwork or complacency sets in.

Factors that can impair objectivity include the lack of formalized investigative protocols and practices and the lack of ongoing monitoring and measuring of investigation progress and concerns. Conflicts over investigation "ownership" among participating staff and line personnel, leading to turf battles, can also affect objectivity, as can performance incentives that reward investigators solely on the number of cases resolved or dismissed. In addition, investigators who focus primarily on guilt as opposed to exculpatory information are prime candidates for losing their objectivity.

Similar to what is required of prosecutors in criminal cases, investigators should also be required to prepare investigative reports and other communications. These documents should include not only information obtained that points to guilt, but also information that may exonerate a suspect. Ignoring or failing to document such information is a serious investigative flaw, with potential for severe consequences.

Experienced investigators allow the facts to speak for themselves in a concise, accurate, and professional manner. They use adjectives sparingly, allowing the reader to draw inferences or conclusions based on direct observations, physical evidence, or documentation. They also ensure that the general tone of the report is objective and that both opinions and facts are properly labeled. Conclusions about guilt or innocence should not be made.

Once lost, objectivity may be hard to regain. Researchers have found that people, including investigators, revise their judgments of events after the fact. These revised judgments are based on two phenomena. One is called "creeping determinism," the sense that grows on a person, in retrospect, that what happened was inevitable. The second is known as "hindsight bias," meaning the inability to be objective when the outcome is known. In other words, people who know--or think they know--a result tend to believe that they would have predicted the reported outcome or event. The same principle holds even if the belief is false, so where investigators think they know who the guilty party is, all evidence may seem to point in that direction.

Experienced investigators often form preliminary opinions or impressions at the start of an investigation. They develop a theory, say, about whether a fraud was committed and who the likely suspects are. They then begin weighing investigative information against known facts and evidence.

Forming a hypothesis is an acceptable step, not to be confused with losing one's objectivity by jumping to a conclusion. But during the investigation, it is important that investigators keep their hypotheses to themselves and use great care when discussing the investigation with managers and others.

Investigators must recognize that implying guilt can destroy an employee's career. It can also, as noted earlier, expose the company to liability, especially if the investigation clears the employee of wrongdoing. Investigators must, therefore, choose their words carefully. They must also protect the confidentiality of the investigation, preserve the integrity of the process, and protect the reputation of those under investigation.

In one case illustrative of how not to behave, an employee was under investigation on suspicion of embezzling. One of the investigators told a friend about the investigation and identified the suspect. After nearly two months of investigation, no conclusive proof emerged to attribute the crime to the suspect or to anybody else. A short time later, the suspect left the company and applied for another job. During the job interview, the interviewer mentioned that he knew that the candidate had embezzled money from his previous employer. The interviewer had learned about the crime from the friend of the investigator. When the applicant pushed for details, the interviewer revealed his source of information. Subsequently, the applicant sued his previous employer for defamation and won a $250,000 judgment.

Independent corroboration.
Most credible information on losses, sexual harassment, and other problematic activities comes from employee tips. But workers are also the source of incorrect or misinterpreted tips.

Employees come forward with information about activity that they believe is unethical or that they believe violates company policy. Often these observations are based on a limited understanding of the facts. Employees might equate a simple procedural error with a significant violation of company policy, for example. They might also be misled by rumor or hearsay. And, of course, sometimes employees have malicious intent, wanting to settle a grudge, perhaps. All initial tips and other information collected during the inquiry must, therefore, be independently corroborated.

Consequently, comments from any one witness should be corroborated by others if possible. And investigators should strive to substantiate personal statements with company records or other hard evidence. This step may require pouring over business records to ensure that they accurately describe the events in question.

Investigators seeking evidence must look beyond the company records, which may have been tampered with. This is of particular importance when dealing with electronic data such as computerized documents and e-mails, where the author of the document or address of the subject under investigation can be disguised or forged.

One example of the problems created by not corroborating facts involved a bank teller suspected of theft. Based on a statement by a colleague who said she had "seen the suspect take money from her teller drawer and put it in her blouse," a fraud investigation was initiated. For two weeks, everyone in the branch was questioned, and it was obvious to everyone interviewed that the teller was the target of the investigation. The suspect felt humiliated and embarrassed.

After an extensive investigation, it was determined that the accused teller was innocent and that the accusing colleague was trying to get the teller in trouble in an effort to steal her boyfriend. The accused teller, though proven innocent, felt she had to quit her job and take a position in another institution. The entire problem could have been avoided had the investigators corroborated the accusation by examining teller records before questioning any employees. The deposit and withdrawal records from the teller's drawer showed no shortages. In the aftermath, the woman sued her employer and settled the case for an undisclosed amount.

Investigative tools.
With advances in technology, there are more tools available to use in investigations. Some are low-tech, such as anonymous hotlines. Some tools--such as covert CCTV--must be carefully weighed and legally vetted before being used. Other tools can help in compiling facts and detecting patterns. Of the newer tools, data analysis has emerged as one of the most prominent and promising.

Data analysis tools can help investigators cull relevant evidence from corporate databases and servers. Access to the appropriate database can reveal important, independent facts that direct and support investigations.

As an example of the power of database analysis, two of the authors were involved in a case in which a large organization received an anonymous tip regarding kickbacks occurring between some company employees and a third-party custodial contractor. As explained in the tip, the person reporting the problem thought that too much work was given to a specific contractor team.

As part of an independent investigation, the authors connected to the corporation's databases and downloaded information from three tables relevant to the specific area of the organization. Data were summarized into six-month periods that showed three totals per period: the amount authorized by each company buyer to each contractor, invoice charges made by each buyer, and actual amounts paid to contractor work crews.

The data showed 169 company buyers who averaged $143,000 each in purchases across ten six-month periods. One buyer, however, had averaged almost $4 million in purchases during the same timeframe. The invoice-charge spreadsheet showed a similar pattern, with most buyers charging relatively small amounts compared with the one buyer charging significant invoices.

The most telling comparison was the corporate data compared with the actual amounts paid to contractors. These data came from a different set of tables and had to be cross-referenced and standardized to the same scale as the authorization/charge data. The summarization showed a single work crew of a third-party contractor receiving more than $8 million in payments during the five-year period. Most other work crews averaged only $1 million in payments. It was apparent that the buyer and the work crew had some connection.

After the data analysis was complete, traditional techniques were performed to further investigate the company buyer and contractor work crew, such as total time, hours billed, and the number of locations at which the contractor had worked simultaneously. It turned out that the people involved were close relatives and that the company buyer had been funneling work to his family's crew. In this case, the data provided independent evidence that not only supported the traditional investigation techniques but also directed specific investigation activities and made the investigation much more efficient and effective than it otherwise would have been.

Unreliable techniques. Centuries ago, hot irons were placed on a suspect's tongue. If the individual was telling the truth his natural saliva would supposedly protect him. Conversely, if he was lying, his mouth would be dry and the iron would burn him immediately. Like most unethical approaches, this technique was not only cruel, it was also ineffective. Some modern day so-called devices, such as voice stress analyzers, are successors to the hot iron test in that they offer investigators the false hope of being able to tell with absolute certainty when someone is telling the truth. In other cases, companies go to the wrong type of expert to examine evidence, leading to inaccurate conclusions.

In one case, for example, a mid-sized company's CEO received several threatening letters from someone who described himself as a "concerned employee." Since the company did not have a security function, both the internal audit and human resources departments were asked to investigate and find out if the letters came from a current or past employee.

Several examples of employee handwriting from employees, believed by HR staff to be troublemakers or upset with the company were obtained from personnel files. The samples were taken to a graphologist, or handwriting analyst, rather than to a Certified Questioned Documents Examiner (CQDE), to determine whether any of the suspect samples matched the handwriting in the letters.

A certified documents examiner holds a degree in the physical sciences and has years of laboratory experience under the supervision of an experienced examiner. By contrast, graphologists can obtain their designation through home study courses. Graphologists may have legitimate expertise, but they are typically trained to infer a person's character from handwriting, not to identify fraudulent documents.

The graphologist identified two employees as the authors of the threats. Instead of being fired, however, the employees were given a chance to turn themselves around and were required to undergo psychological counseling. Both employees acted bewildered at the charges, and their continued denials almost got them fired from the company because they were interpreted as refusal to acknowledge their transgressions. But they ultimately agreed to counseling.

Approximately one and one-half years later, the psychiatrist conducting the counseling sessions contacted the company and advised it that the employees continued to deny any knowledge of the threatening letters. He added that, based on his observations, testing, and experience, he believed that it was highly likely that the two employees were innocent and may have been subjected unnecessarily to psychological counseling.

At this point, management solicited the advice of expert security consultants. They directed management to a CQDE, who in turn requested additional samples from employee records. The examiner issued a written opinion in which he identified a different employee as the culprit. When confronted, the employee confessed to management that he was indeed responsible for the threatening letters written almost two years earlier.

In addition to using poor investigative tactics, investigators in this case failed to keep the facts confidential, causing substantial embarrassment for the innocent employees when coworkers found out. Although neither employee sued the company, this case illustrates the importance of conducting investigations with competent resources and great care.

Experienced investigators discount scientifically unproven methods. They also make sure that any technique they use is sound and fair.

Far too many investigations are botched or terminated because proper investigative protocols were not followed. But as experienced investigators know, they are more likely to solve a case with thoroughness and a dogged pursuit of the truth than from heavy-handed tactics or trickery.

W. Steve Albrecht is Andersen Professor and Associate Dean at Brigham Young University's Marriott School of Management, in Provo, Utah. Conan Albrecht is assistant professor of information systems at the Marriott School, and Chad Albrecht is a graduate of Brigham Young University. Timothy L. Williams, CPP, is the vice president of corporate and systems security at Nortel Networks, Brentwood, Tennessee. He is a member of ASIS International.



The Magazine — Past Issues


Beyond Print

SM Online

See all the latest links and resources that supplement the current issue of Security Management magazine.