Auditor as an Investigator?

February 19, 2021

As auditors, we are sometimes called upon to participate in investigations at our institution. Investigations may be the result of a financial fraud allegation, a complaint of time misappropriation submitted through an ethics hotline, or a management request regarding questionable travel and entertainment expenses. To some, the word “investigation” may be intimidating. In hopes of demystifying the process, this article provides general information on investigations, why they are performed, and what auditors should consider while conducting an investigation.

What is an investigation?

Performing investigations exhibits...that the institution is committed to an ethical culture rooted in honesty and accountability.

An investigation is a determination of facts related to a specific concern (or concerns) raised by an individual (e.g., via hotline complaint or management request) or, less often, as the result of an audit. The results of an investigation include determining whether the concerns are substantiated by assessing what happened, the timeline of events, and what policies or laws were violated. The matters under investigation often implicate an individual in wrongdoing, so they require a discrete, thorough, and independent analysis. Confidentiality is critical throughout an investigation to protect both a falsely accused person and the overall integrity of the process. While limited in scope, investigations focus on facts solely related to the concern(s) presented; provide all parties with an opportunity to be heard; and provide management with clear and concise findings, as well as potential recommendations when appropriate.

Why do auditors perform investigations?

As auditors, we are uniquely suited to perform the detailed, analytical work required to complete a thorough investigation. In addition, higher education auditors tend to have a breadth of institutional knowledge and an expansive professional network. We are independent, trained to recognize fraud red flags, and know what areas to focus on. Furthermore, there is a need—employee reports are the most common sources of uncovering fraud. Performing investigations exhibits to your institution’s community—students, faculty, staff, patients, visitors—that the institution is committed to an ethical culture rooted in honesty and accountability.

Auditor Considerations

General

Maintaining confidentiality is in the best interest of all parties involved in an investigation and should be discussed based on the nature of the investigation and parties involved
Review of documentation and interviews should be limited to the specific concerns raised
Availability of audit professional resources should be considered to complete investigations timely
Investigations inherently have increased litigation risk; therefore, the results (and supporting work-papers) of a given investigation may be subject to a subpoena if the matter is not resolved to either party’s satisfaction
All parties are entitled to an impartial, objective, and thorough investigation and have the right to be presumed innocent unless proven otherwise

Maintaining confidentiality is in the best interest of all parties involved.

Planning the Investigation

Understand the concern under investigation (interview hotline reporter or management, if necessary)
Identify, and request, any information necessary to substantiate the concern (e.g., general ledger, procurement details, Travel and Entertainment records, time system logs, emails, people to interview)
Review and identify any policies or regulations that may have been violated
Consider the amount of information provided by hotline reporters prior to moving forward with performing an investigation

Performing the Investigation

Follow procedures developed for audit investigation fieldwork and documentation
Maintain a document log as work-papers are requested, received, and prepared
Access to all documentation and work-papers should be limited to only those who have a need-to-know (i.e., Principle of Least Privilege)
All work-papers, both paper and electronic versions, are potentially subject to subpoena and must be maintained (refer to your institution’s record retention policy or general counsel for guidance)
Maintain open communication between team members, management, and peer units at the institution (e.g., Human Resources, Police Department, Compliance), disclosing only pertinent information for the investigation
Seek guidance from your institution’s General Counsel as to whether including “Confidential and Privileged”, or a similar statement, is appropriate to identify all work-papers, if included in the investigation’s legal documentation

Interviewing Key Participants

Conduct interviews in a location comfortable (and neutral) for you and the interviewee[1]
Identify pertinent questions requiring answers prior to the interview
Prepare for each interview individually (different interviews will warrant different questions)
- Ask open-ended questions
- Keep questions short and simple
- Let the interviewee do most of the talking
Maintain an interview log (e.g., who, when, where)
Interview the individual accused of wrong-doing last

Reporting the Investigation Results

Write a straightforward report. (i.e., concern, procedures performed, conclusion)
Consider the necessity of including supporting documentation as appendices to report
Determine who the report will go to and who will be included on the distribution list
Complete report writing timely (definition is subjective at each institution and the nature of the investigation)

Common Jargon

Becoming familiar with and understanding key terms will help you navigate an investigation with ease. Below are some terms and definitions commonly used during the investigations process:

Term	Explanation
Allegation	Claim or assertion that someone has done something illegal or wrong
Arbitration	A form of alternative dispute resolution; a way to resolve disputes outside of court
Attorney/Client Privilege	Legal protection to keep communications between attorneys and clients confidential
E-discovery	Electronic information requested to be produced during litigation
Evidence	Compilation of documents and analyses supporting a conclusion
Grievance	Formal complaint raised by an employee within the workplace
Hotline	Reporting tool, typically with option to report anonymously
Hotline Reporter (or Complainant)	Individual initiating hotline report (or complaint)
Mediation	Dispute resolution using an impartial third party trained in specialized communication and negotiation techniques
Target (or Respondent)	Individual whom a hotline report is against
Participant	An individual interviewed and/or identified as a witness during an investigation
Subpoena	A court order commanding a person to appear in court
Substantiated	Results of an investigation support the concern/allegation
Unsubstantiated	Results of an investigation do not support the concern/allegation

Conclusion

In closing, remember we are all investigators. Use your auditor tool box to perform tests and analyses to assist in closing an investigation. Document everything and file it separately from other audit work-papers. Communicate often with the investigation team and ask questions of the investigation owner (whether inside, or outside of, your audit department). Utilize the experience to learn a new process and/or deepen working relationships within your institution. Learn more about partnering with other investigative units at your institution at ACUA’s Audit Interactive 2021.

[1] Given the current pandemic, interviews may need to be conducted virtually. To conduct a virtual interview in as similar of circumstances as meeting in-person, all parties should utilize a video setting and be in a room without distractions.

About the Author

Erin Egan

Erin Egan, CPA, CIA, is the Director of Audit and Advisory Services at Rutgers, The State University of New Jersey. After starting her career in auditing and consulting, Erin joined Rutgers in 2009. She enjoys the challenges of working in higher education and appreciates the ability to help the university achieve its mission. Erin has volunteered for ACUA throughout the years by speaking at conferences, writing articles, and currently serves as the Director of the Auditing and Accounting Principles sub-committee. She can be reached at erin.egan@rutgers.edu.

Articles
Auditor as an Investigator?
New Global Internal Audit Standards Released
The Significance of Cost Transfers