Predication and Engagement Planning in Fraud Examinations

Predication does not require proof of fraud: it requires a reasonable basis to suspect it. The standard is objective, not subjective. The question is not whether the fraud examiner personally believes the allegation, but whether a reasonable professional with equivalent training and experience would believe that the facts and circumstances justify investigation.

Predication can arise from many sources. A whistleblower report through a hotline is one of the most common. According to the ACFE's Report to the Nations, tips are consistently the leading fraud detection method globally, accounting for more than 40 percent of initial detections in most survey years. Other sources include anomalies identified during internal or external audit, unexplained variances in financial statements, complaints from vendors or customers, observations by line managers, referrals from regulatory bodies such as the Securities and Exchange Commission (SEC) in the United States, the Financial Conduct Authority (FCA) in the United Kingdom, or the Securities and Exchange Board of India (SEBI), and referrals from law enforcement.

The predication assessment should be documented before the examination begins. The documentation records the source of the allegation, the facts and circumstances that constitute the predication, the date on which predication was assessed, and the name and qualifications of the person who made the assessment. This record protects the organisation if the examination is later challenged and provides the basis for the working hypothesis.

A fraud examination is not an open-ended search. It is a structured inquiry driven by a hypothesis. The working hypothesis translates the predication into a specific, falsifiable statement that fieldwork can test. A hypothesis that is too broad produces an unfocused examination that is expensive, slow, and legally vulnerable. A hypothesis that is too narrow may miss related conduct.

A well-formed hypothesis has four components. First, the scheme type: is this a cash-skimming scheme, a billing fraud, a payroll ghost-employee scheme, a financial-statement manipulation, or a corruption arrangement? Classifying the suspected scheme against the ACFE Fraud Tree helps identify the expected evidence trail and the likely control failures that enabled it. Second, the suspected actor or group: the hypothesis names the role, if not yet the individual, most likely responsible. Third, the time period: when did the scheme likely begin, and is it ongoing? Fourth, the mechanism: how did the perpetrator allegedly execute the scheme and convert it to personal benefit?

The hypothesis is provisional. It will be revised as fieldwork produces evidence. If early evidence refutes the initial hypothesis, the examiner revises or abandons it and, if the new evidence points to a different scheme, documents the new predication that justifies a revised scope. What the examiner must not do is ignore evidence that refutes the hypothesis in order to support a predetermined conclusion. That is a professional and ethical violation, and it produces testimony that will not survive cross-examination.

Scope is the boundary of the examination. It defines what will be examined and, by implication, what will not. The scope statement should be written before fieldwork begins and should name: the organisational units or business processes in scope, the time period, the transaction types or accounts to be reviewed, and the evidence sources, including documents, electronic data, and potential witnesses.

Scope creep is one of the most common problems in fraud examinations. It typically begins when early fieldwork reveals tangential irregularities. The examiner must resist the impulse to follow every anomaly. If a tangential finding constitutes new predication for a separate scheme, the correct response is to document that predication, obtain authorisation to expand scope from the engagement principal, and proceed. If it does not constitute predication, note it in the workpapers and do not pursue it.

The scope statement should also address access rights: which systems, premises, and records the examination team has authority to access, and under what legal framework that authority is granted. In an employment context, this may derive from the employment contract and the organisation's electronic monitoring policy. In a regulated-industry context, regulatory inspection powers may provide broader access. In a criminal investigation, law enforcement search warrants define and limit access. Clarifying this before fieldwork begins prevents access disputes mid-examination.

A fraud examination team typically combines financial expertise, legal counsel, and sometimes digital forensics capability. The forensic accountant or fraud examiner leads the financial analysis and interviewing. Legal counsel advises on the legal framework, privilege, and admissibility; in many jurisdictions, running the examination under legal privilege protects the work product from disclosure in subsequent proceedings. Digital forensics specialists handle electronic evidence collection, preservation, and analysis when the scheme involves manipulated records, unauthorised system access, or electronic communications.

Team size and composition should be proportionate to the scope. A single-perpetrator cash-skimming scheme in a small department may require only one examiner and counsel. A multi-jurisdictional financial-statement fraud may require teams in multiple cities, forensic technologists, and specialised legal counsel in each jurisdiction. Overstaffing a small examination increases cost and leak risk; understaffing a complex one creates bottlenecks and missed evidence.

Conflicts of interest must be assessed before team members are assigned. An examiner who has a personal or professional relationship with the subject of the examination, or whose firm has a consulting relationship with the department under review, should be recused. Independence is not merely an ethical requirement: it is a legal one in many jurisdictions, and expert testimony from a conflicted examiner is routinely challenged and sometimes excluded.

Before any evidence is collected, a legal hold must be issued to prevent the destruction of potentially relevant documents and data. Legal counsel issues the hold notice to document custodians, directing them to preserve all documents, emails, electronic files, and other records related to the defined scope, regardless of normal document-retention or deletion schedules. The hold notice should be issued before the investigation is disclosed to any custodian who is not in the need-to-know group.

Spoliation, the destruction or alteration of evidence after a hold obligation has arisen, can have severe consequences. In US federal litigation, Rule 37(e) of the Federal Rules of Civil Procedure authorises sanctions including adverse inference instructions. In the UK, the courts have drawn similar adverse inferences under common law principles. In India, the Bharatiya Sakshya Adhiniyam 2023 (which replaced the Indian Evidence Act 1872) preserves the principle that a party's unexplained failure to produce relevant evidence can support an adverse inference. Preventing spoliation is one of the primary reasons the legal hold must precede any other investigative step.

For electronic evidence, the hold must also address automated deletion processes. Email systems may be configured to delete messages after a retention period. Cloud storage services may have automated purge policies. The legal hold notice must reach the system administrators responsible for those automated processes, not just the document custodians. Forensic imaging of key systems early in the engagement, before those automated processes run, is often the safest approach.

The examination plan translates scope, hypothesis, and team composition into a sequenced set of fieldwork steps. The sequence matters. Evidence collection should proceed from the least intrusive and most document-based steps first, preserving the opportunity for interviews to be conducted after the examiner has a complete picture of the documentary record. Interviewing a target before reviewing the financial evidence is a common error: the examiner who does not yet know what the documents show cannot effectively confront or probe a deceptive account.

A standard examination plan has four phases. The document review phase secures and analyses the financial records, system logs, contracts, and electronic data relevant to the hypothesis. The data analytics phase applies quantitative tests, including Benford's Law analysis, duplicate payment detection, vendor master file anomaly analysis, and trend analysis, to identify transaction patterns consistent with the suspected scheme. The interview phase begins with non-subject witnesses, proceeds to cooperative witnesses, and concludes with the subject, if an interview of the subject occurs at all. The reporting phase synthesises the findings into a written report addressed to the engagement principal.

The plan should also define the criteria for concluding the examination. A fraud examination does not run until all fraud is found: it runs until the hypothesis is supported or refuted by the available evidence, or until the engagement principal determines that further expenditure is not justified by the expected return. The examiner should define, in advance, what evidence would constitute sufficient support for the hypothesis to warrant referral, and what evidence would cause the examination to be closed with a finding of insufficient support.

See Evidence Gathering Methods in Fraud Examinations for detailed coverage of the document review and data analytics steps, and Interviewing Suspects and Witnesses for the interview phase.