Take the first steps when workplace fraud is suspected

Define the concern neutrally

Write down the event or discrepancy that triggered concern. Separate the observed fact from the explanation you suspect. “Two payments share an invoice reference” is a checkable observation; “an employee stole the money” is a conclusion that requires evidence.

Identify who is responsible for the initial response and whether HR, legal, finance or IT input is needed. A concern involving a senior person or a conflict of interest may require an independent decision-maker. Keep circulation limited to those who need to be involved.

Protect relevant information lawfully

List the records that may help, who controls them and whether they are at risk of routine deletion. Ask the authorised team to preserve relevant material through the proper process. Do not improvise access to personal accounts or assume that employment gives unlimited rights to search or monitor.

A workplace investigation should be fair and consider information that supports and challenges the allegation. Acas guidance emphasises reasonable fact-finding and respect for privacy. Employment decisions and any criminal reporting need appropriate advice in the circumstances.

Build a small decision record

Keep a chronology of what was reported, by whom, what action was authorised and why. Record facts separately from confidential advice. If a concern may involve a cyber incident, coordinate with incident responders rather than independently altering systems.

• The specific concern and its source.
• Relevant records and possible deletion deadlines.
• Who can authorise access or preservation.
• Known conflicts of interest and reporting lines.
• Immediate financial, operational or safeguarding issues.
• The next review point and the decision it should inform.

Keep the enquiry open to another explanation

A duplicate entry may have an innocent cause; a plausible explanation may also need verification. Test both. Avoid discussing allegations widely, staging a confrontation or directing witnesses toward an expected answer. Let the appropriate adviser guide interviews and employment procedure.

Free first step: prepare a neutral one-page account and an evidence index using the blank downloads. PDC can discuss whether independent fact-finding would help and how its scope would fit alongside HR, legal or IT work. If funds may be moving or systems are compromised, use your urgent bank and incident-response processes immediately rather than waiting for a routine enquiry.

Questions you may have