Your company has received an allegation that one of its employees has stolen from it and has now completed the steps discussed in our first article – Managing Corporate Risk When Employee Fraud is Suspected. The company is satisfied the allegation has merit and has preserved a forensic copy of the company’s data. So, what are the next steps?
This article will discuss the steps involved in conducting an independent forensic investigation, preserving the company’s data and evidence, and obtaining remedies in court to protect the company’s interest pending a potential judgment against the employee. We note that this article is focused on situations involving larger frauds perpetrated by employees and may not necessarily apply to smaller cases of employee dishonesty. Each company will need to tailor its approach to its specific situation and weigh the costs of further steps against the anticipated benefits.
Engage Third Parties Early – Now that the company has completed its internal investigation, the focus will need to shift to engaging outside experts and legal advisors. Depending on the company’s situation, its next phone call will likely be to its insurance broker or lawyer:
The insurance broker will be able to review the company’s insurance policy to determine whether, and to what extent, there is coverage for losses caused by employee fraud. If the company has employee fidelity coverage, there will be timelines for when the insurance company must be notified and steps that must be taken from there. Some insurers will require an independent investigation and a quantification of the loss to be submitted with a proof of loss. The policy may cover the cost of legal fees and a forensic investigation, so it is wise to talk to the company’s broker before incurring those expenses. The company will need to work closely with its insurer throughout this process.
A lawyer will help the company navigate the suspension or termination of the employee and attend court to obtain pre-judgment remedies to help trace and preserve the employee’s assets for any future recovery of the loss. A lawyer can also engage a forensic accountant on the company’s behalf who will be able to complete a formal forensic investigation and, if necessary, prepare a report which can be used in court to assist in obtaining a judgment against the employee. These steps are discussed below.
Employment Considerations – After the company has taken a forensic copy of its data and completed its internal investigation, it should determine how to mitigate any further risk posed by the employee. This will include the following:
Suspension or Termination of the Employee – The company will need to decide whether the employee should be suspended with pay (pending the results of a further investigation) or terminated for cause. The company should consult an employment lawyer before taking any steps that will alter the employee’s employment status to avoid a potential claim for wrongful dismissal. It is best practice to interview the employee prior to his or her termination. Depending on the nature of the fraud, a forensic accountant can conduct this interview on behalf of the company as part of its investigative process, discussed below. At the time the employee is terminated for cause, the company can serve them with any filed copies of court orders, noted below, along with a copy of a Statement of Claim. If the company chooses not to suspend the employee until it has the results of the investigation or has gathered additional evidence, any additional losses arising thereafter may not be covered by insurance - coverage for the employee fraud typically ceases on the date the issue was discovered.
Revoke the Employee’s Access to the Company’s Systems – An employee may be able to access the company’s systems both on site and remotely, so access to the physical premises will need to be revoked (e.g. access card), access to all digital systems will need to be revoked (e.g. email and VPN), and hardware will need to be returned (e.g. company phone and laptop). If the employee has signing authority or online access at the company’s bank, that should also be revoked. If the employee works remotely, which is now more common due to COVID-19, the company will have to determine the best way to ensure any devices are returned quickly and unaltered. Depending on the seriousness of the offence, and the ongoing risk to the company, this may involve sending someone to the employee’s house, sending a pre-paid shipping package to the house, or arranging for the employee to bring the hardware to the office.
Protect the Company’s Future Interests – The company should engage a lawyer early to mitigate its ongoing risk. Depending on the extent of the fraud, the lawyer may attend court (without notice to the employee to obtain certain pre-judgment remedies to protect the company’s interests going forward. These remedies can include:
A pre-judgment attachment order – This is an order obtained pursuant to the Civil Enforcement Act and will freeze the employee’s exigible property. This is an important remedy that will prevent the employee from emptying their bank account or selling assets before the company has obtained a judgment against them and has an opportunity to collect. To obtain this order, the company will have to show that (i) it has a reasonable likelihood that its claim against the employee will be established, and (ii) there are reasonable grounds for believing that the employee is dealing with their property, or is likely to deal with that property, otherwise than for the purpose of meeting their reasonable and ordinary business or living expenses and in a manner that would seriously hinder the company’s enforcement of a judgment. In fraud claims, where the company can show a reasonable likelihood that its claim against the employee will be established, the court may conclude, on that basis alone, that there are reasonable grounds for believing the employee is likely to deal with their property to the company’s prejudice.
A Norwich order – This is an order that will allow the company to gain access to third party records, such as the employee’s bank records. This will assist the forensic accountant in tracing the funds from the company’s bank account to the employee’s bank accounts and beyond. This will also provide the company with a better understanding of the employee’s assets, so it can later take steps to preserve them. A court will consider numerous factors in determining whether to grant such an order, such as whether the interests of justice favour disclosure of the records.
An order pursuant to the Land Titles Act – This is an order that will allow the company to conduct name searches at the Land Titles Office. This will permit the company to determine whether the employee owns any real property.
Once the company has obtained these orders, it can register them against the certificates of title to any applicable lands and at the Personal Property Registry. This will help to ensure that real and personal property are not sold before the company is able to obtain a judgment.
Although each case is unique, these steps should be taken once the company is satisfied it has grounds to terminate the employee for cause. If the employee is merely suspended pending an investigation, the company is unlikely to be able to meet the applicable tests noted above. The goal is to ensure employee’s assets are preserved for the future, once the company has obtained a judgment and can begin the collection process.
Obtain an Independent Forensic Investigation Report – While such a report may be costly, it will help the company fully understand how the fraud occurred and to quantify the loss, which may be required for any legal proceedings. As noted, the company should consult its insurer to determine whether this investigation and report would be covered under the terms of any applicable policy. To maintain legal privilege over the report, the lawyer should engage the forensic accounting expert on the company’s behalf. The forensic accountant will review the records that were initially preserved; determine whether any other documents or devices require preservation; interview relevant employees, third parties, and the suspected employee; complete an independent analysis; and finally draft a report. The report will be a useful tool which will assist the company in proving its claim against the employee to the insurer or in court. This will be discussed further in our next article – Collecting on a Loss Caused by Employee Fraud.
Discovering that an employee has been stealing from the company is a stressful experience. In addition to the direct financial loss caused by the fraud, the company may have to incur further expenses in dealing with the investigation, terminating the employee, and hiring legal counsel and forensic accountants to recover on the loss. In determining whether the benefits of such steps outweigh the costs, a company will need to consider numerous factors, including:
Whether such steps will help prevent a future loss by identifying vulnerabilities in the company’s current accounting practices (this will be discussed in our fourth article – Preventing and Detecting Employee Fraud).
What message the company wants to send to its employees (e.g. fraud will not be tolerated, and steps will be taken to recover on the loss);
Whether the company has insurance that will pay for some or all of these expenses; and,
Whether, if successful in obtaining a judgment, the company will be able to collect on its judgment against the employee.
Our next article – Collecting on a Loss Caused by Employee Fraud – will discuss the steps involved in commencing an action against the employee, obtaining a judgment, and collecting on that judgment.
Written by:
Breanne Campbell
b.campbell@svrlawyers.com
403.231.8215
Breanne is a partner at SVR Lawyers and advises clients on a broad range of fraud claims including theft of corporate opportunity, employee embezzlement, and insurance fraud.
Bailey Rivard, CPA, CA·IFA, CBV, CFE, CFF
bailey.rivard@mnp.ca
403.536.2185
Bailey is a partner in MNP’s Valuations, Forensics and Litigation Support Services group. She provides independent investigation and litigation support services to clients and counsel when fraud or other wrongdoing is suspected.
Disclaimer: This article is provided solely for information purposes. The information presented does not constitute legal or professional advice and should not be relied upon for such purposes or used as a substitute for legal advice.