Questions to Ask in a Fraud Investigation
For an internal auditor, compliance officer, HR investigator or business owner who has to interview people about padded expenses, missing money, a vendor that looks wrong or records that do not match. The groups run in the order the interviews usually do: openers for everyone, the person who reported it, the people who run the process and hold the access, the records, the employee whose transactions are in question, and the close. Who may sit in, whether you may record, what you may search and when an insurer or the police must be told are not the same from one country or employer to the next, so get those answers from counsel or HR before the first meeting.
Want questions from the whole vault instead? Try the random question generator.
The questions
Each question, and why to ask it
Opening
What have you been told about why we are meeting, and who told you?
Why ask it
In a money matter the leak matters more than the rumor. If word has already reached the person whose transactions are in question, records may be changing while you talk, so take the name of the source and move securing the files to the top of your list.
What is your role, and which parts of the purchasing, expense or payment process do you handle yourself?
Why ask it
Their own description of the job gets set beside the written job description and the system's access list later. Where those three disagree, look again: a clerk who says she only keys invoices but holds approval rights in the system is a control problem before she is anything else.
How long have you been in this job, and who did it before you?
Why ask it
Tenure tells you whether the pattern you are looking at started before or after this person arrived. The predecessor can describe how the process ran in their day, and sometimes why it was changed.
Do you have any family, financial or outside business connection to the vendors, customers or coworkers we will be talking about?
Why ask it
Put it to every interviewee, and answer it yourself before you take the assignment. A cousin who owns the supplier does not make a witness wrong; it tells you which of their statements to confirm from a second source. A tie they leave out and you find later goes into the report as a finding of its own.
Has anything about how money, stock or records are handled here ever struck you as wrong, even slightly?
Why ask it
An open door before any specifics. Someone who has watched a shortcut for years may say so the first time they are asked, and what they raise can have nothing to do with your case and still deserve a line in the report. With the employee in question, note what they mention and what they leave out, and draw no conclusion from either yet.
The report
What did you see, read or hear that first made you think something was wrong?
Why ask it
Push for the specific thing: an invoice number that repeated, a supplier nobody had met, a refund with no customer attached. A concern that begins with a document can be tested this week. One that begins with a feeling about a coworker needs records before it needs interviews.
When did you first notice it, and how far back do you think it goes?
Why ask it
These are two dates and you need both. The first fixes what the reporter knew and when. The second decides how many months of records to pull, so ask what the estimate rests on.
Which transactions, claims or entries should I pull first?
Why ask it
Three or four examples with dates, amounts and names are enough to start. Once a few items are confirmed you know the method, and the method tells you what to search the rest of the ledger for.
Who else has seen what you have seen, and what would each of them be able to tell me?
Why ask it
Likely names are whoever shares the paperwork, the temp who covered a vacation, the person at the next desk. Find out how close each is to the employee in question before you decide the order, and tell the reporter not to sound anyone out for you.
Had you mentioned this to a manager or anyone in finance before you came to me, and what did they do with it?
Why ask it
A manager who was told and did nothing is either a broken control or part of the problem, and at this stage you cannot tell which. Record the date and the reply, and consider keeping that manager outside the circle of people who know about the investigation.
Do you have copies of anything, and how did you come to have them?
Why ask it
How a document was obtained matters as much as what it shows. Papers the reporter handles as part of the job are one thing; pages taken from a colleague's desk or mailbox may be a problem you need advice on before relying on them. Thank them, and ask them not to gather anything more.
Have you noticed anything about how this person works: refusing help, never taking time off, insisting on handling one vendor or account alone?
Why ask it
Behavior like this is a lead and nothing more. Plenty of honest people guard their work and skip vacations, so write down what was observed, with dates where possible, and leave the reporter's theory about it out of your findings.
What do you stand to gain or lose from how this turns out?
Why ask it
A reporter who lost a promotion to the same person, or who shares the duties under review, can still be right. Asking plainly lets them say it first and lets you show afterward that you weighed it. The documents have no stake either way, which is why they carry the finding.
Are you worried about what could happen to you for raising this?
Why ask it
Name the person they should go to if their hours, duties or treatment change. Protection for people who report wrongdoing differs by country and sector, so describe what your own policy says and do not promise anonymity or legal cover you have not confirmed.
Process and access
Can you take me through how one of these transactions is supposed to go, from the first request to the money leaving?
Why ask it
Draw it as they talk: who asks, who approves, who keys it in, who releases payment, who reconciles afterward. The drawing becomes your yardstick, and each questioned item gets laid against it to see which step it skipped.
How does it really go in a busy week, when someone is out or the month is closing?
Why ask it
Shortcuts live here: the shared login, the approval sent by text, the stack signed without reading. People describe policy when asked about policy and reality when asked about a bad week, so keep any judgment out of your voice while they tell you.
If someone wanted to take money from this company without being noticed, where would it be easiest?
Why ask it
Asked of clerks, approvers and managers, it produces a map of the weak points from the people who work around them every day. A gap that three people name and nobody has fixed belongs in your report whatever else you find. It is a question about the process, so read nothing into who answers it well.
Who can add a new vendor or change a vendor's bank details, and who checks the change?
Why ask it
If one person can both create a supplier and approve its invoices, that person could pay a company that does not exist. Request the change log for the period and read who made each change, when, and whether anyone confirmed it with the supplier by a route other than the email that asked for it.
What are the approval limits, and who signs at each level?
Why ask it
Get the limits in writing, then look at the amounts. Claims and invoices bunched just under a threshold, or one purchase split into several on the same day, are easy to search for and worth putting to whoever approved them.
Who holds the passwords, company cards, signature stamps, blank checks or bank tokens, and who else has ever borrowed them?
Why ask it
A system log records which login was entered, not who was sitting at the keyboard. Learn about shared credentials before you put any entry to the person whose name is on it, because 'everyone knows my password' is a defense you want to have tested already.
When this person is on vacation or out sick, who does their work?
Why ask it
Follow with when they last took a full week away and whether anything odd came up while they were gone. Some schemes need daily attention and show themselves during an absence. Whoever covered belongs near the top of your interview list.
Who reconciles the bank account, the card statement or the stock count, and is that person separate from whoever records the entries?
Why ask it
When the recorder and the reconciler are the same person, the reconciliation shows whatever they chose to show. Look at the last few, and get the supporting statements straight from the bank or card issuer instead of from the file.
When cash, checks or card payments come in, who receives them, who records them and who takes them to the bank?
Why ask it
Money can go missing before it is ever recorded, which leaves no entry to question. Look for one person doing all three jobs, then set the till rolls, receipt books or customer statements beside the deposits for a sample of days.
Has anyone asked you to skip a step, approve something without the paperwork or push a payment through in a hurry?
Why ask it
Meant for clerks and approvers. Take down who asked, how the request arrived and the reason given at the time. Staff who went along with a plausible excuse from someone senior often feel implicated, so make it clear you are asking what happened, not hunting for someone to blame for following an instruction.
Who chose this vendor, and how were the price and terms checked?
Why ask it
The file should hold quotes, a contract and the name of whoever signed it. A single-source supplier is not evidence of anything. One picked without quotes, whose prices creep upward and whose invoices always go to the same approver, has earned a comparison with what others charge.
What was actually received for this payment, and who saw it arrive or put it to use?
Why ask it
Delivery is the weak point of an invoice for something that never existed. Put the question to the person who would have needed the goods or the service, not the one who approved the bill, and ask where the item is now.
Records
Where are the originals kept, on paper and in the system, and who can get to them?
Why ask it
Collect originals before anyone under review knows you want them. Keep a simple log of what you took, from where, from whom and on what date, since a document nobody can trace back to its source is easy to dispute later.
Which system logs show who created, changed and approved this entry, and how long are they kept?
Why ask it
This one goes to IT, not to the person whose entry it is. Some logs are overwritten after a set period, so ask for them to be preserved the same day. Reading mailboxes or personal devices is a separate matter with its own rules in each country and each employer's policy, so get that cleared before anyone opens one.
Is this your signature, your initials or your login on this approval?
Why ask it
Hand over the page and give them time. 'That is not my signature' changes the case. 'It is mine, but I sign fifty of these on a Friday without reading them' tells you just as much, about the control instead of the person.
What paperwork should sit behind a payment like this, and which pieces are missing?
Why ask it
Ask the process owner for the list before they see the file: order, receipt, delivery note, contract, timesheet. Setting the standard first stops it from being quietly adjusted to fit whatever turns out to be in the folder.
Has anything been altered, replaced, backdated or thrown away since people began asking questions?
Why ask it
Offer the ordinary causes yourself, such as the monthly shredding run or an archive box sent off site, so that a yes is easy to give. Afterward, compare the answer with file dates, print dates and the system's change history: an invoice reprinted last week for a payment made last spring is a question for the next meeting.
Is there a record outside the company that would show the same transaction: a bank statement, the supplier's own copy, a customer's remittance?
Why ask it
Outside records are the hardest for an insider to change, which makes them the best check on inside ones. Some the company can simply request. Others need the other party's consent or a legal process, and counsel can tell you which is which where you are.
How was this figure worked out, and can you rebuild it for me now?
Why ask it
Useful for mileage, commissions, overtime, stock adjustments and manual journal entries. Whoever prepared an honest number can usually get back to it from the source data. If they cannot, your next question is where the number came from.
Can you match employee addresses, phone numbers and bank accounts against the vendor file, and list any invoice numbers or receipts that appear twice?
Why ask it
A request for finance or IT, made before the later interviews. A hit is a starting point: check when the detail was added to the vendor record, and by whom, before reading anything into it. Bring the results to the interviews so nobody is asked to guess what the data shows.
The discrepancies
Before we look at anything, how do you normally put together a claim or process an invoice like the ones you handle?
Why ask it
Hear their version of normal before any questioned item is on the table. It commits them to a standard in their own words, and each departure from it later is measured against what they said, not what you assumed.
This is claim [number], dated [date], for [amount]. What was it for?
Why ask it
Go one item at a time with the document in their hands, and say nothing about what you think is wrong with it. Write the answer down as spoken and go on to the next item. Testing the answers comes after you have collected them.
The receipt says [detail] and the entry says [detail]. Can you help me understand the difference?
Why ask it
Stay with the two facts and leave 'why did you' out of the sentence. A genuine mistake tends to come with something checkable, such as a second trip, a reissued invoice or an email from a manager. Verify it before you meet again.
Who asked you to do it this way, or told you it was acceptable?
Why ask it
'My manager said it was fine' is either a defense or a second person to look at. Pin down when it was said, in what form and whether a message exists. Then interview that manager without repeating what you were told.
Has [vendor], or anyone connected with it, ever given you anything: gifts, meals, tickets, trips, a loan, work on your home, cash?
Why ask it
Name the forms a benefit can take, because someone who would deny a kickback may readily mention the season tickets. Compare the answer with the gift register or conflict of interest declaration, if the employer keeps one, and with what this person said in the opening about ties to suppliers.
Is there any reason your home address, phone number or bank account would appear against this payment?
Why ask it
Put it before you show the match. A reason offered now, such as a relative at the same address who really is a contractor, can be checked like any other fact, and hearing it first is fairer than springing the printout and watching the reaction.
When you submitted this, did you know it was not accurate?
Why ask it
Ask it once, plainly, after the items have been gone through and never as the opener. Whether the person knew is what separates an error from something more serious, and that judgment belongs to the decision-maker, so take the answer down in their words. A denial is an answer too: go on to the next question and do not repeat this one louder.
Was there a time you spent company money on something personal, even if you meant to put it back?
Why ask it
Some people in this position think of it as borrowing, and the wording leaves room to say so. If an admission comes, keep your face and voice level, ask how many times and roughly how much, then go back to the items one at a time.
If I went through everything you submitted or processed over the same period, what else would need explaining?
Why ask it
It lets the person set the scope before you do. 'Nothing' and 'maybe a few more' both go into the notes as said, and neither changes the plan: the whole period gets reviewed anyway, and the answer is compared with what the review turns up.
What happened to the money, and is any of it still available?
Why ask it
Only after an admission. The answer, whether a personal account, a relative or a debt paid off, tells you which records exist outside the company and what the person deciding on recovery has to work with. Do not discuss repayment terms, or what paying it back would mean for their job, in this meeting: neither is yours to offer.
Did anyone else know about this, help with it or share in it?
Why ask it
Two people acting together can defeat a separation of duties that works on paper. Cover inside the company and outside it as separate questions. Treat any name as a lead to confirm in the records before you approach that person.
What was going on for you at the time that would help me understand this?
Why ask it
Debt, illness in the family or a target that could not be met sometimes comes out here. Record it in their words. It explains without deciding anything, and if the person seems distressed, pause and let HR know so that support can be offered.
Who or what would back up the explanation you have given me?
Why ask it
Leads that might clear the person get the same effort as leads against them: call the supplier, find the email, pull the trip record. Write in the file what each check showed, and which ones you decided not to make and why. Some explanations do hold up, and the report should say so plainly.
Would you be willing to put what you have told me in writing, in your own words?
Why ask it
Let them write it; never dictate. Do not trade it for a promise of leniency or raise the police to get it. Whether a written statement should be taken at all, and with what warnings, is a question for counsel before the meeting, not during it.
Closing
If you were doing my job, where would you look next?
Why ask it
People who work inside a process know its soft spots better than any outsider. A clerk may point to a second account or a different supplier, which widens the review. Asked of the employee in question, a redirection toward a coworker is worth noting and checking, not accepting.
Who knows this process well enough to tell me what normal looks like, and has had no part in these transactions?
Why ask it
You want a benchmark: someone outside the questioned items who can say whether receipts are always attached or whether nobody ever checks. When several interviewees give the same name unprompted, book that person early.
Do you have anything of the company's at home or on a personal device: files, cards, keys, a laptop?
Why ask it
For the employee in question, and for anyone about to be placed on leave. Arrange the return with a list both of you sign. Asking for the company's property back is one thing; looking through a personal phone or account is another, and how far an employer may go there is something to ask counsel about beforehand.
Have you been treated fairly in this meeting, and is there anything you were not given the chance to say?
Why ask it
Ask it of the employee in question above all, with your note-taker writing the reply as spoken. An objection to how the interview was run is far easier to deal with in the room than when it first appears in an appeal. If the answer is no, find out what they would have wanted done differently and record that as well.
Can you keep this conversation, and the fact that anyone is looking at these transactions, to yourself for now?
Why ask it
Explain why it matters here in particular: a paper file can be thinned out in an afternoon, and one phone call to a supplier can produce a replacement invoice. Ask HR or counsel beforehand how the request may be worded, because how far an employer can insist on silence is not the same everywhere.
Do you know what happens after today and who to contact if something comes up?
Why ask it
Tell them what is certain and stop there: more records will be looked at, you may need to speak to them again, and a named person other than you decides what follows. Whether an insurer, a regulator or the police hear about it is that person's call. Leave a direct number in case a missing document turns up or a colleague starts asking what was said.
Running fraud interviews that hold up
Practical guidance for the conversation itself
Before anyone is interviewed
Secure the records before the word spreads
Have the originals, the system logs and copies of the relevant mailboxes preserved before any interview that could alert the person under review. Ask IT how long each log is kept, and ask HR or counsel what the employer's policy lets you read.
Keep the circle small, and outside the process
Report to someone who has no hand in the transactions you are examining. If a manager in the approval chain could be involved, the investigation answers to the owner, the board or an audit committee, and that manager learns of it when the interview plan says so.
Ask about the rules early
Representation, recording, suspension, data privacy, legal privilege and any duty to notify an insurer, a regulator or the police all differ by country, sector and contract. Put those questions to counsel in the first days, because an answer that arrives after the interviews cannot be applied to them.
Write the theory down, and what would disprove it
One page is enough: the suspected method, the records that would show it, the people who touch each step, and the innocent explanations you will check. A plan that lists only what would confirm the suspicion produces a file that confirms it.
Who to interview, and in what order
Start furthest from the suspicion
The usual order is the person who reported it, then neutral witnesses and the people who run the process, then anyone who may have helped, and last the employee whose transactions are in question. Each interview tells you which documents to bring to the next.
Why the employee in question comes last
By then you can put specific items to them instead of a general worry, which is fairer to them and more useful to you. They get to answer the evidence itself, and you can tell a checkable explanation from a vague one because you already know the paperwork.
One person at a time, two of you if possible
Interview people separately, in a private room, with one of you asking and the other writing. Begin by saying who will read the notes and that someone else makes any decision. Keep the person's own manager out of the room, and avoid a setup that feels like being cornered: a clear path to the door and a stated right to take a break cost nothing.
When the order has to change
If money is still leaving, or the person has heard and records are at risk, stopping the loss comes before a tidy sequence. Take it to whoever has authority over payment holds, system access and leave, and ask how suspension works under your policies before anyone is sent home.
Putting documents to people
Copies on the table, originals in the safe
Number each copy and note in your record which ones were shown to whom. Later, the question of whether someone had seen invoice 14 when they gave their answer will matter, and your numbering settles it.
Open question first, pointed question second
'What can you tell me about this payment?' comes before 'Why is it going to your address?' The open version lets an honest person explain in their own order and lets you hear what a less honest one chooses to leave out.
Never bluff, promise or threaten
Do not claim to hold evidence you lack, hint at an outcome you do not control or mention the police as a lever. Apart from being unfair, in many places it can undermine whatever the person then says, so ask counsel where the lines sit for you.
Check the innocent explanation as hard as the guilty one
Miscoded expenses, a receipt submitted twice by accident and a real supplier with sloppy invoices all look like fraud on a spreadsheet. Test each explanation against the records and write the result in the file whichever way it comes out.
After the interviews
Write up each interview the same day
Record the date, the start and end times, who was present, the documents shown and the answers as close to the spoken words as you can manage. Keep your impressions in a separate paragraph, labeled as yours.
Report what the records show, and leave the label to others
State which transactions lack support, who processed and approved them, and what each person said. Whether that amounts to fraud in the legal sense, and what follows for the employee, belongs to the decision-maker and their advisers.
Count the loss conservatively
Include only amounts the documents support, give the period you reviewed, and say plainly what you did not review. A smaller figure that survives challenge is worth more to an insurer or a court than a larger estimate that does not.
Close the gap that made it possible
Whatever the finding, the weakness you uncovered is still open: the shared login, the vendor nobody verified, the reconciliation done by the person who made the entries. Give each one a named owner and a date, and check that it was done.