Auditor as an Investigator?
February 19, 2021
As auditors, we are sometimes called upon to participate in investigations at our institution. Investigations may be the result of a financial fraud allegation, a complaint of time misappropriation submitted through an ethics hotline, or a management request regarding questionable travel and entertainment expenses. To some, the word “investigation” may be intimidating. In hopes of demystifying the process, this article provides general information on investigations, why they are performed, and what auditors should consider while conducting an investigation.
What is an investigation?
Performing investigations exhibits...that the institution is committed to an ethical culture rooted in honesty and accountability.
An investigation is a determination of facts related to a specific concern (or concerns) raised by an individual (e.g., via hotline complaint or management request) or, less often, as the result of an audit. The results of an investigation include determining whether the concerns are substantiated by assessing what happened, the timeline of events, and what policies or laws were violated. The matters under investigation often implicate an individual in wrongdoing, so they require a discrete, thorough, and independent analysis. Confidentiality is critical throughout an investigation to protect both a falsely accused person and the overall integrity of the process. While limited in scope, investigations focus on facts solely related to the concern(s) presented; provide all parties with an opportunity to be heard; and provide management with clear and concise findings, as well as potential recommendations when appropriate.
Why do auditors perform investigations?
As auditors, we are uniquely suited to perform the detailed, analytical work required to complete a thorough investigation. In addition, higher education auditors tend to have a breadth of institutional knowledge and an expansive professional network. We are independent, trained to recognize fraud red flags, and know what areas to focus on. Furthermore, there is a need—employee reports are the most common sources of uncovering fraud. Performing investigations exhibits to your institution’s community—students, faculty, staff, patients, visitors—that the institution is committed to an ethical culture rooted in honesty and accountability.
- Maintaining confidentiality is in the best interest of all parties involved in an investigation and should be discussed based on the nature of the investigation and parties involved
- Review of documentation and interviews should be limited to the specific concerns raised
- Availability of audit professional resources should be considered to complete investigations timely
- Investigations inherently have increased litigation risk; therefore, the results (and supporting work-papers) of a given investigation may be subject to a subpoena if the matter is not resolved to either party’s satisfaction
- All parties are entitled to an impartial, objective, and thorough investigation and have the right to be presumed innocent unless proven otherwise
Maintaining confidentiality is in the best interest of all parties involved.
Planning the Investigation
- Understand the concern under investigation (interview hotline reporter or management, if necessary)
- Identify, and request, any information necessary to substantiate the concern (e.g., general ledger, procurement details, Travel and Entertainment records, time system logs, emails, people to interview)
- Review and identify any policies or regulations that may have been violated
- Consider the amount of information provided by hotline reporters prior to moving forward with performing an investigation
Performing the Investigation
- Follow procedures developed for audit investigation fieldwork and documentation
- Maintain a document log as work-papers are requested, received, and prepared
- Access to all documentation and work-papers should be limited to only those who have a need-to-know (i.e., Principle of Least Privilege)
- All work-papers, both paper and electronic versions, are potentially subject to subpoena and must be maintained (refer to your institution’s record retention policy or general counsel for guidance)
- Maintain open communication between team members, management, and peer units at the institution (e.g., Human Resources, Police Department, Compliance), disclosing only pertinent information for the investigation
- Seek guidance from your institution’s General Counsel as to whether including “Confidential and Privileged”, or a similar statement, is appropriate to identify all work-papers, if included in the investigation’s legal documentation
Interviewing Key Participants
- Conduct interviews in a location comfortable (and neutral) for you and the interviewee
- Identify pertinent questions requiring answers prior to the interview
- Prepare for each interview individually (different interviews will warrant different questions)
- Ask open-ended questions
- Keep questions short and simple
- Let the interviewee do most of the talking
- Maintain an interview log (e.g., who, when, where)
- Interview the individual accused of wrong-doing last
Reporting the Investigation Results
- Write a straightforward report. (i.e., concern, procedures performed, conclusion)
- Consider the necessity of including supporting documentation as appendices to report
- Determine who the report will go to and who will be included on the distribution list
- Complete report writing timely (definition is subjective at each institution and the nature of the investigation)
Becoming familiar with and understanding key terms will help you navigate an investigation with ease. Below are some terms and definitions commonly used during the investigations process:
|Claim or assertion that someone has done something illegal or wrong
|A form of alternative dispute resolution; a way to resolve disputes outside of court
|Legal protection to keep communications between attorneys and clients confidential
|Electronic information requested to be produced during litigation
|Compilation of documents and analyses supporting a conclusion
|Formal complaint raised by an employee within the workplace
|Reporting tool, typically with option to report anonymously
|Hotline Reporter (or Complainant)
|Individual initiating hotline report (or complaint)
|Dispute resolution using an impartial third party trained in specialized communication and negotiation techniques
|Target (or Respondent)
|Individual whom a hotline report is against
|An individual interviewed and/or identified as a witness during an investigation
|A court order commanding a person to appear in court
|Results of an investigation support the concern/allegation
|Results of an investigation do not support the concern/allegation
In closing, remember we are all investigators. Use your auditor tool box to perform tests and analyses to assist in closing an investigation. Document everything and file it separately from other audit work-papers. Communicate often with the investigation team and ask questions of the investigation owner (whether inside, or outside of, your audit department). Utilize the experience to learn a new process and/or deepen working relationships within your institution. Learn more about partnering with other investigative units at your institution at ACUA’s Audit Interactive 2021.
Given the current pandemic, interviews may need to be conducted virtually. To conduct a virtual interview in as similar of circumstances as meeting in-person, all parties should utilize a video setting and be in a room without distractions.
About the Author
Erin Egan, CPA, CIA, is the Director of Audit and Advisory Services at Rutgers, The State University of New Jersey. After starting her career in auditing and consulting, Erin joined Rutgers in 2009. She enjoys the challenges of working in higher education and appreciates the ability to help the university achieve its mission. Erin has volunteered for ACUA throughout the years by speaking at conferences, writing articles, and currently serves as the Director of the Auditing and Accounting Principles sub-committee. She can be reached at email@example.com
Auditor as an Investigator?
The Significance of Cost Transfers