Employee Fraud Investigation: What to Do in the First 72 Hours
This is the highest-urgency guide on our site - for employers who have just discovered suspected fraud and need immediate, practical guidance on preserving evidence and engaging experts.
Immediate
Before You Do Anything Else
- Do not alert the suspect
- Do not access their computer or systems yourself
- Do not discuss with colleagues who may warn the suspect
- Time is critical - assets can be moved within hours
Hour 1
Hour 1 - Secure the Evidence
- Do not delete, move, or access suspect's files or emails
- Preserve financial records in their current state
- Note what you know and when you discovered it
- Call a forensic accountant and civil fraud solicitor
Hours 2–4
Hour 2–4 - Engage Experts
- Instruct a forensic accountant under legal professional privilege (via your solicitor) to begin preliminary assessment
- The forensic accountant assesses the scale of the fraud and the evidence available
- Solicitor advises on immediate legal steps (freezing injunction, search order, POCA report)
Day 1
Day 1 - Preliminary Assessment
- Forensic accountant reviews financial records
- Identifies the fraud type, approximate quantum, and how long it has been occurring
- Identifies connected parties (accomplices, third parties)
- Advises on civil vs criminal route
Days 2–3
Day 2–3 - Legal Steps
- Freezing injunction application (if assets at risk of dissipation)
- Search order (Anton Piller) if evidence at risk
- Norwich Pharmacal order (to identify wrongdoers)
- Police report (if criminal proceedings appropriate)
- Suspension of employee (following HR procedure)
Week 1–2
Week 1–2 - Full Investigation
- Forensic accountant conducts full investigation under legal professional privilege
- Evidence-quality workpapers prepared
- Loss quantification completed
- Expert witness report prepared (CPR Part 35 if civil proceedings)
Civil vs Criminal - Which Route?
| Route | Aim | Outcome | Speed |
|---|---|---|---|
| Civil recovery | Recover money | Judgment + asset recovery | Months–years |
| Criminal prosecution | Punish offender | Conviction + POCA confiscation | Years |
| Both simultaneously | Punish + recover | Maximum recovery | Staged |
| Employment tribunal | Dismiss + recover | ET award | Months |
Preserving Legal Professional Privilege
Forensic accountants working under legal professional privilege produce reports that are protected from disclosure to the opposing party - protecting the employer's legal strategy. This requires the forensic accountant to be instructed via the solicitor, not directly by the employer. Learn more →
Suspected employee fraud? Get expert help today.
Submit your details and we will match you with a qualified UK employee fraud expert witness. Employers and solicitors welcome. Response within 1 business day.
Get Expert HelpOr email contact@employeefraudexpert.com