Filling the fraud examiner's toolbox

By Stephen Pedneault, CFE, CPA, CFF

In any trade, a technician needs the right tools for a job. Knowledge built upon education, training and experience provides the needed skills. But without the right tools, a technician can only conceptualize the job at hand.

For example, an electrician completes specialized schooling, works as an apprentice, passes exams and ultimately obtains a license — all while working in the trade to gain experience.

However, the two most decisive factors that directly influence the electrician's successful career will be: 1) the ability to determine the best electrical solution for each situation, and 2) the tools within his toolbox. Without a voltmeter, cordless drill, wire cutters and other tools, the electrician can't start — let alone finish — the job.


Of course, a fraud examiner also can't complete an examination without the right tools.

An accounting firm once called my office with a potential issue involving one of their clients — a local distributor of products to global customers. We immediately arranged a meeting for that afternoon.

I thought about the skills and tools I would bring to the discussion — even though I wouldn't need them right away — to ensure my office could react to the potential client issue. From the little I gleaned from the call, the potential matter involved an employee who held a financial position with the company.

I expected to encounter some type of theft, abuse or embezzlement. So, I prepared my usual basic toolbox (actually a briefcase), which includes a tablet computer with applications for taking notes and recording the meeting in audio and video. I also bring a spiral-bound notebook in case the tablet malfunctions.

I also always carry in my car a "fraud response" bag — an oversized briefcase containing miscellaneous items dedicated to fraud examinations. It contains the tools I need to safeguard and collect physical and electronic evidence: evidence bags, "evidence" tape to seal boxes or cabinets, static bags, USB jump drives, evidence markers and a digital camera. Because I never know when I'll receive my next fraud case or where I'll be when it does I always carry the bag.

Of course, no single fraud examiner possesses every hypothetical skill and tool needed to resolve a client matter. We must possess the ability to know what else we'll need and how to get other qualified individuals involved, such as:

  • Computer forensic experts.
  • Handwriting experts.
  • Surveillance and personal protection specialists.
  • Translators.

Most of these associates and I possess a similar mindset, and they're ready to respond to my call for help.


I've worked as an ambulance crew volunteer and EMT for the past 18 years. Medical emergencies and client financial issues are similar. Both require careful triage: a calm, levelheaded and objective assessment of a situation's needs.

Once I identify the main problem in either world, I can implement a careful plan and identify ancillary issues along the way. Some cases require immediate action, like a cardiac arrest or an employee actively stealing from an employer. In other cases, I have more time to create and implement a course of action. In both lines of work, I've usually found that everyone looks to me to identify the strategy or immediate approach.

In the accounting firm case, I attended the initial meeting along with the business owner, the partner of the accounting firm and my associate. The owner said his controller was embezzling funds. One accounting member — we'll call her Martha — had tracked the embezzlement activity in detail and told other staff members about her findings.

During the controller's recent unplanned absence, several accounting department employees came to the owner to tell him about the problems. Up until his absence, the controller had always arrived every day earlier than others and stayed after everyone else had left for the evening — the better to watch the suspicious accounting department members, they said.

We forged a plan to immediately tackle the problem, especially because the controller still worked for the company and didn't seem aware that the owner now knew of the thefts. The owner said he couldn't immediately act that day to preserve evidence, so I planned to arrive at the company first thing in the morning.


The ability to triage a situation and develop a course of action is important; the ability to immediately react to changes as a scenario unfolds is even more important. An afflicted patient can go from alert to unconscious in mere seconds. Though financial crimes and crises are hardly life-and-death situations, we still should consider them urgent matters.

Soon after I arrived at my office the next morning after the meeting, Martha called to say that she had just confronted the controller and presented him with the evidence. "I got him," she proudly informed me. She had confined him to a conference room and seized his laptop computer. I was dismayed — Martha had gone rogue! Now she'd completely changed everything.

I had to act fast. I was 90 minutes away from the client's office, and I couldn't know if the controller would voluntarily remain in the conference room or leave and find his lawyer. I knew that I'd only get one opportunity to interview him, so I dictated an outline to a colleague as we drove to the company.


Miraculously, when we arrived at the company, the controller was still in the conference room, reading a book. I needed to assess his state of mind and begin the seemingly impossible process of building rapport with someone I've never met — abruptly thrown into a conference room at the start of his day. I had to read his body language, listen for paralinguistics (not what he said but how he said it — tone, timbre, pitch, pace, dysfluencies) and his choice of words.

I began by introducing myself and my colleague and apologized for his treatment. I explained that I had indeed eventually planned on meeting with him but not in this manner. I gave him a summary of my understanding of some issues identified to me, and explained that I wanted to hear his side of the accounting department employees' allegations.

He spent the first hour providing a few meager details. I gave him examples of identified transactions, but he denied everything repeatedly. The room had no clocks, and I hadn't told him how long we'd be meeting, so I pressed on. I gave him more evidence and he continued to deny any fraud for another hour.

Somewhere around the 2½-hour mark, I decided we needed a break. I said I was going downstairs to talk with the owner for a few minutes and would then return. I told him that prior to that morning, this interview had been the only course of action anybody had taken. I said that at the end of our meeting, the company would explore its options for resolution. I asked him one final question before we took the break. "Is there anything you want me to tell the owner, while we are still at this early stage, with no one else involved, that I might convey to him during the break?"

A big question — and a big break in the interview. He asked me to tell the owner that he loved his job, that it was his "… most favorite job ever." He said to tell the owner that he did everything for the company as the controller, and would do whatever he had to do to make things right with the owner and the company. He said that he never took any money or did anything improper, but given the facts and situation, he again said he'd be willing to "…make things right." For 2½ hours, the controller denied any wrongdoing, but then changed his tone to show his willingness to resolve the matter. Someone wrongfully accused of doing something inappropriate generally won't be willing to make restitution, so this signified his first acknowledgement of being caught.

My colleague remained with the controller while I went to meet with the owner. I found him sitting anxiously in his office. I told him the controller had come to terms with what he had done. I invited the owner to the meeting with the controller.

I spent the next hour mediating the interactions between the owner and controller, who apologized for putting the owner and the company in this awkward position. He again repeated his offer to make things right. At the end of the meeting, the owner and I thanked the controller, and he was escorted to his car.

The company eventually fired the controller. Within two weeks of his admission, we had collected all the supporting evidence of his actions, and the controller wrote a check to the company covering the full amount of the loss and the investigation costs. The owner didn't file any criminal charges against him. We recently learned that the former controller is now the chief financial officer at a large manufacturing company.


If you implement the most appropriate measures at the right times and use your tools, skills and abilities, you can make a direct impact upon the successful resolution of a client matter even when you encounter some detours. Along with the tools discussed in this case, collect evidence, perform data analytics, interview witnesses, document your case, prepare a well-written report, present your findings and deliver a competent testimony — that's how we successfully resolve cases. These are the cornerstones upon which you build your reputation for future engagements.

Stephen Pedneault, CFE, CPA, CFF, is the owner of Forensic Accounting Services, LLC.

Enhance your toolbox by checking out the resources available during the ACFE's Fraud Awareness Week.

Read more insight and discuss this article in the ACFE's LinkedIn group

The Association of Certified Fraud Examiners assumes sole copyright of any article published on or ACFE follows a policy of exclusive publication. Permission of the publisher is required before an article can be copied or reproduced. Requests for reprinting an article in any form must be emailed to