The growing demand for investigation skills in compliance

Recent years have seen an increasing number of internal investigations around the world. This is the result of multiple factors, including heightened regulatory scrutiny, the growing use of deferred prosecution agreements, and a cultural shift within regulated companies to support a “speak-up” and “listen-up” culture.

Leaks such as the FinCEN Files, Luanda Leaks, and Panama Papers have left organizations (especially those within the financial sector) exposed. Many have received public criticism for doing “just enough” to meet regulatory obligations but failing to take steps to investigate or prevent abuses from taking place. These leaks and the corresponding fallout help fuel a change in culture to one in which whistleblowing is taken more seriously—a culture where regulated firms are expected to take more responsibility to investigate and prevent the types of abuses that have been uncovered and to make sure they are being seen to do so.

The impact from the public’s response to leaks and investigations is far from the only factor that has been attributed to this cultural shift. The #MeToo and Black Lives Matter movements have had a huge effect, both in empowering employees to speak out and in demonstrating to companies they need to listen to those employees.

The impact of COVID-19

There is no indication the number of internal investigations will start to slow, and the ongoing global pandemic is expected to accelerate their occurrence.

To understand why, we must recognize how working from home is seen to carry a higher risk of potential misconduct. One way of demonstrating this is to consider the “Fraud Triangle”: A framework developed by criminologist Donald R. Cressey that seeks to explain the three factors that typically lead to fraud. Where all three factors of the triangle are present, the risk of fraud is significantly increased:

Opportunity. Employees working from home are potentially subject to less oversight and a lack of relevant controls because systems were not set up for staff to work remotely. While at home, individuals are in a comfortable environment with no colleagues around, and they might feel they are less likely to be “found out.” In addition, due to the economic pressures of the pandemic, companies may look to make savings in nonrevenue departments, such as compliance. This can lead to a lack (either perceived or real) of defenses and safeguards against misconduct, thereby increasing opportunity.

Pressure. Financial pressure is currently the most obvious burden under which staff might labor. During the pandemic, employees become concerned about finances due to fears about the economic impact and recession, wage cuts, being furloughed, or the perceived risk of being laid off. Alternatively, staff could be troubled by the consequences of failure as they struggle to meet targets in a downturned market. All these factors can increase pressure on individuals. These issues could also manifest as an indirect pressure where a partner or dependent, for example, is facing these risks and pressures directly.

Rationalization. Wage cuts, placing staff on furlough, or potential layoffs can also lead to employees becoming disaffected, and a sense of entitlement from the organization may creep in. The pandemic is a time when individuals might rationalize actions as protecting their family and their future.

The increased risk of employee misconduct is one aspect that can lead to more investigations but is not the only one. There have also been reports the pandemic is itself leading to more instances of suspected or confirmed fraud committed by employees.

As the focus was once on moving from a tick-box to a risk-based approach, the compliance world is now looking to build more effective approaches to combat misconduct. In the area of investigations, one of the key methods to increase effectiveness is through the appropriate use of technology.

Workers without physical access to the office might no longer be able to cover up prior malfeasance through access to physical ledgers and records or secretly logging into a colleague’s machine out of hours. As cash flows slow, it might be more difficult to cover up lost funds, as there is less money to move around. For example, the Bernie Madoff Ponzi scheme might have gone undiscovered for much longer, had it not been for the recession in 2008.

What investigation skills are needed?

As the focus was once on moving from a tick-box to a risk-based approach, the compliance world is now looking to build more effective approaches to combat misconduct. In the area of investigations, one of the key methods to increase effectiveness is through the appropriate use of technology.

Most of the information we produce today is electronic, typically in the form of email, chat, documents, and spreadsheets. The pandemic has accelerated the move to electronic data even further, with information that remained paper-based quickly becoming electronic to enable employees to successfully work from home.

In many internal investigations, electronic data is often key. There is therefore a need to make sure the information is correctly collected and preserved. This is important, not only so it can be efficiently investigated for signs of potential wrongdoing, but so it can subsequently be relied upon in court or by the appropriate regulators or enforcement agency.

Digital forensic technologies can not only assist in ensuring the data is correctly preserved but can also help to investigate hidden electronic information behind the files. For instance, it could help determine if intellectual property has been stolen from an organization, perhaps to take to a competitor or even set up a new company in direct competition. On top of this, it could be used to determine if a file or email is authentic or has been faked in some way.

Using a wide number of different technologies, eDiscovery tools can assist with searching data, identifying and tagging relevant information, and using advanced analytics and AI to suggest other information that might also be relevant. The technology was originally designed for use in disclosure matters, where it filters vast data sets down to just the relevant information in a dispute. It is therefore perfect for use in investigations, where electronic data such as emails or documents need to be analyzed for signs of wrongdoing.

Understanding the technologies involved can be of huge benefit to compliance professionals, driving efficiency into procedures in order to build more effective investigations.

While it might not be necessary to have the skills to run an eDiscovery or digital forensic investigation from start to finish, possessing an understanding of the technology and how it can be employed is absolutely key to building effective investigations.

The International Compliance Association is a sister company to Compliance Week. Both organizations are under the umbrella of Wilmington plc.