When Should a Business Launch a Corporate Investigation? Fraud, Theft and Employee Misconduct

What organisations should preserve, who should be involved and how to choose an investigation method before evidence disappears.

By Navid Sobbi, Founder and CEO, NSI Global

PUBLISHED: 18 January 2023  SUBSTANTIVELY UPDATED: 1 October 2026

When fraud, theft or employee misconduct is suspected, the first investigation decisions can determine whether an organisation eventually proves what happened or unintentionally destroys the evidence needed to establish it.

A rushed response can be as damaging as no response at all. Confronting an employee too early may prompt deletion or alteration of records. Allowing a computer to be reimaged or a phone to be reset can remove forensic artefacts. Searching accounts without a clearly established authority may create privacy, employment or evidentiary problems. And an investigation that begins without a defined question can expand into an expensive search for wrongdoing rather than a focused effort to establish facts.

The scale of occupational fraud helps explain why disciplined response matters. The Association of Certified Fraud Examiners’ 2026 global Report to the Nations analysed 2,402 occupational-fraud cases across 143 countries and territories. The median loss was US$104,000, the typical scheme lasted 12 months before detection, and 43% of cases were detected following a tip. Those figures are global benchmarks rather than Australian prevalence estimates, but they reinforce a practical point: fraud and misconduct often develop over time, and the quality of the response after the first credible indicator matters.

When Should a Business Launch a Corporate Investigation?

A formal corporate investigation should normally respond to a defined trigger: an allegation, anomaly, incident, credible intelligence, whistleblower report, control failure or other fact pattern that creates a legitimate question requiring evidence.

That is different from routinely investigating employees without cause. Organisations should maintain appropriate controls, audits, reporting channels, fraud-risk monitoring and governance. A formal investigation begins when there is a sufficiently clear issue to test.

• Unexplained financial loss, suspicious payments, false invoices or procurement anomalies.
• Theft or misuse of stock, equipment, confidential information, intellectual property or other company assets.
• Evidence that an employee may be operating a competing business, misusing company resources or acting under an undisclosed conflict of interest.
• Unusual transfer, copying or access to commercially sensitive files, client information or proprietary material.
• A credible whistleblower allegation or internal complaint requiring independent fact-finding.
• Insurance or workers’ compensation matters where evidence raises a legitimate question about the accuracy or circumstances of a claim.
• Indicators of bribery, corruption, vendor collusion or an undisclosed relationship affecting a business decision.
• A suspected information leak, data misuse or insider activity requiring coordination between investigators, legal counsel and digital-forensics specialists.

The First Question Is Not ‘Who Did It?’

A well-scoped investigation begins with the issue to be established, not a predetermined conclusion about the person suspected. The investigation plan should identify what is known, what remains uncertain and what evidence could distinguish between competing explanations.

• What exactly is alleged to have happened?
• What facts would establish or disprove the allegation?
• What time period matters?
• Which devices, systems, accounts, documents or witnesses may hold relevant evidence?
• Who has lawful authority to access that material?
• Is there a risk that evidence will be altered, deleted or overwritten?
• Could early contact with the subject compromise the investigation?
• Is litigation, dismissal, regulatory reporting or criminal referral reasonably foreseeable?
• Should legal counsel direct or supervise aspects of the investigation?

This approach reduces confirmation bias. It also makes the investigation more proportionate because each collection step can be tied to a defined question rather than an open-ended search.

Different Allegations Require Different Evidence

Corporate investigation is not synonymous with physical surveillance. Surveillance can be appropriate in some matters, but other allegations may be answered more effectively through financial records, interviews, digital evidence, access logs, background research, open-source intelligence, CCTV, procurement records or a combination of methods.

• Financial fraud may require invoices, payments, approval chains, banking records and relationship analysis.
• Employee misconduct may require interviews, workplace records, digital artefacts, access-control records and policy evidence.
• Intellectual-property theft may require forensic examination of laptops, phones, cloud accounts, USB activity, email, file transfers and deleted artefacts.
• Conflict-of-interest or vendor matters may require corporate-record research, beneficial-ownership analysis, relationship mapping and due diligence.
• Insurance or workers’ compensation matters may require lawful field investigation, surveillance, witness evidence and documentary corroboration.
• Information-leak matters may require digital forensics and, where there are credible indicators of physical eavesdropping, a separate TSCM assessment of the environment.

Preserve Digital Evidence Before Normal IT Processes Alter It

Standard IT administration and forensic evidence preservation have different objectives. IT teams are usually trying to restore service, secure systems, replace hardware or return a device to a known-good state. A forensic investigation may need to preserve the current state because deleted files, timestamps, log records, application artefacts and other metadata can be central to reconstructing what happened.

Where a company-owned device or account may hold evidence, early actions should be coordinated. Depending on the matter, unnecessary steps can include reimaging a computer, factory-resetting a phone, reinstalling software, running cleanup utilities, allowing continued use of the device or casually opening files to see what they contain.

NSI Global’s Digital Forensics and Digital Evidence Services support authorised matters involving employee misconduct, intellectual-property theft, insider threat, fraud, unauthorised access and evidence preservation. Where a matter requires incident triage and forensic response, Digital Forensic Incident Response can be integrated with the wider investigation.

Corporate Fraud, Theft and Misconduct Are Not the Same Investigation

Fraud and Financial Misconduct

Fraud investigations may involve false invoicing, payment manipulation, procurement abuse, undisclosed relationships, expense fraud, corruption or misuse of organisational resources. The evidence can cross accounting systems, email, approvals, vendor records, corporate registries and digital devices.

Employee Theft and Misuse of Assets

Theft may involve physical stock or equipment, but it can also involve confidential information, client lists, intellectual property, credentials, data or other non-physical assets. The investigation method should reflect what is allegedly being taken and how the loss could have occurred.

Employee Misconduct and Competing Interests

Where an employee is suspected of operating a competing business, misusing company time or resources, or acting under an undisclosed conflict, relevant evidence may span business records, communications, device activity, access records and lawful field enquiries. The objective is to establish conduct and chronology, not simply to confirm management suspicion.

Whistleblower and Internal Allegations

Internal reports can provide the first credible indication of misconduct. The ACFE’s 2026 global study found that tips were the most common detection method, accounting for 43% of occupational-fraud cases. Once a tip is received, the challenge becomes preserving confidentiality, assessing credibility and defining a proportionate evidence plan without compromising procedural fairness.

Insurance and Workers’ Compensation Matters

These matters require care. A claim should not be treated as fraudulent merely because it is costly or disputed. Where there are legitimate inconsistencies or evidence-based concerns, a properly scoped investigation can gather relevant facts through lawful and proportionate methods for assessment by the insurer, employer, legal team or other authorised decision-maker.

A Corporate Investigation Needs Authority, Scope and Proportionality

The fact that information may be useful does not automatically create authority to collect it. Corporate investigations may intersect with employment obligations, privacy, surveillance laws, computer-access restrictions, whistleblower protections, contractual rights and evidence requirements. The applicable issues vary with the jurisdiction, the workplace, the device or account involved and the purpose of the investigation.

For that reason, sensitive matters should be scoped around lawful authority and legitimate investigative purpose. Where dismissal, litigation, regulatory reporting, criminal referral, privilege, employee communications or covert methods may become relevant, early legal advice can help determine how the investigation should proceed.

For a separate discussion of investigative boundaries, see Legal Limits of Private Investigators in Australia.

When Should Legal Counsel Be Involved?

Legal counsel should be considered early when the matter may lead to disciplinary action, litigation, a regulator, law enforcement, a whistleblower issue, a serious privacy question or contested access to communications or devices. Counsel can also help define the legal questions, manage instruction pathways and determine how privilege should be handled.

The investigator’s role is to establish facts within the authorised scope. Legal conclusions and employment decisions belong with the organisation and its advisers. Keeping those roles clear reduces the risk that an investigation becomes outcome-driven.

A Practical Corporate Investigation Workflow

1. Define the allegation. State precisely what needs to be established or disproved.
2. Identify and preserve volatile evidence. Determine which devices, accounts, documents, logs or records are at risk of alteration or deletion.
3. Establish authority and governance. Confirm who is instructing, who may access the evidence and whether legal counsel should direct aspects of the matter.
4. Develop competing hypotheses. Identify reasonable alternative explanations so the enquiry does not begin with a predetermined answer.
5. Select proportionate collection methods. Use the evidence source that best answers the question rather than defaulting to surveillance or device examination.
6. Correlate evidence across sources. Compare digital, physical, financial, documentary and witness evidence to reconstruct chronology and relationships.
7. Test findings against alternatives. Ask what would have to be true for another explanation to fit the evidence.
8. Report evidence, findings and limitations. Distinguish observed facts from inference and identify material gaps.
9. Decide what follows. The organisation, legal team, insurer, regulator or other authorised decision-maker determines disciplinary, civil, remediation or referral action.

When One Investigation Becomes Several Disciplines

Modern corporate matters frequently cross traditional investigative boundaries. A suspected theft matter can become a digital-forensic investigation when deleted communications or file transfers are identified. A misconduct enquiry can reveal misuse of corporate systems or a competing business. A fraud matter can expose previously undisclosed relationships requiring enhanced due diligence. A suspected information leak can require TSCM if there are specific indicators of physical eavesdropping or covert surveillance.

The correct response is not to apply every capability to every case. It is to follow the credible risk pathways and bring in the appropriate discipline when the evidence justifies it.

NSI Global’s Corporate Investigators work across fraud, internal misconduct, intellectual property, due diligence, asset tracing and corporate-security matters. Where an investigation expands beyond conventional fact-finding, NSI Global can coordinate relevant in-house capabilities including digital forensics, DFIR, counterintelligence and TSCM within an authorised scope.

What a Corporate Investigation Report Should Deliver

A useful investigation report should do more than summarise activity. It should identify the question asked, evidence obtained, how material was collected and preserved, what the evidence supports, what remains uncertain and any limitations that materially affect the findings.

That discipline matters because investigation findings may later be reviewed by management, lawyers, insurers, regulators, courts or another investigator. A conclusion that cannot be traced back to evidence is difficult to defend.

Frequently Asked Questions

What Triggers a Corporate Investigation?

A corporate investigation is usually triggered by a credible allegation, anomaly, control failure, whistleblower report, unexplained loss, suspected misconduct or other defined issue requiring evidence. The trigger should be clear enough to frame an investigation question.

Should an Employee Be Told They Are Under Investigation?

Not automatically at the outset. Timing depends on the nature of the allegation, procedural requirements, legal advice, evidence-preservation risk and whether early notification could compromise the investigation. Organisations should avoid treating secrecy as a default and instead decide notification timing within the authorised investigation plan.

Can an Employer Examine a Company-Owned Computer or Phone?

Potentially, where the organisation has the lawful authority and an appropriate investigation purpose, but ownership alone should not be treated as a universal answer to every privacy, employment or access issue. Sensitive examinations should be scoped around the applicable policies, authority, jurisdiction and legal advice.

What Evidence Is Used in a Corporate Fraud Investigation?

Depending on the allegation, evidence can include financial records, invoices, approvals, email, messaging, device artefacts, cloud records, access logs, CCTV, interviews, public records, corporate records and other material relevant to the transaction or conduct being investigated.

Can Deleted Messages and Files Be Recovered?

Sometimes. Recoverability depends on the device, application, storage method, encryption, cloud services, backups, deletion method and subsequent use. Early forensic preservation generally provides the best opportunity to identify what remains available without unnecessarily altering the evidence.

When Is Covert Surveillance Appropriate in a Corporate Investigation?

Only where it is lawful, authorised, proportionate and relevant to the investigation question. Surveillance is one investigative method, not the default response to every allegation.

Can Corporate Investigation Evidence Be Used in Court?

Evidence may be used in legal proceedings where it is relevant and has been obtained and preserved appropriately. Admissibility and evidentiary weight depend on the facts, jurisdiction, method of collection and applicable law. Where litigation is foreseeable, legal and forensic input should be considered early.

How NSI Global Supports Corporate Investigations

NSI Global conducts authorised corporate investigations for organisations, law firms, insurers and government clients involving fraud, misconduct, intellectual property, asset tracing, due diligence, insurance and corporate-security matters. Investigations can combine field enquiries, interviews, background research, surveillance, digital forensics and data analysis where appropriate to the scope.

Where digital evidence is involved, NSI Global’s forensic team preserves and examines relevant devices and data under documented evidence-handling procedures. Reports set out the evidence, method, findings and limitations so decision-makers can understand both what has been established and what has not.

If your organisation has identified a credible fraud, theft, employee-misconduct or insider-risk issue, contact NSI Global for a confidential discussion before avoidable changes are made to potential evidence.

Sources and Further Reading

1. Association of Certified Fraud Examiners – Occupational Fraud 2026: A Report to the Nations
2. NSI Global – Corporate Investigators
3. NSI Global – Digital Forensics and Digital Evidence Services
4. NSI Global – Digital Forensic Incident Response
5. NSI Global – Legal Limits of Private Investigators in Australia
6. NSI Global – Beyond the Scope of a Private Investigator