At this stage the investigator should (1) complete the collection of internal documents and data from the victim organization and (2) interview current or former employees of the organization, as necessary, who are not involved in the suspected wrongdoing.
Collect, discreetly, if possible, internal documents and data regarding the suspect:
- Transactions, e.g. the contract on which kickbacks were allegedly paid;
- Contractor(s) or consultant(s);
- Official(s) who approved the suspect contract.
Records of the Suspect Transactions
The documents to be reviewed depend, of course, on the facts of the case, but typically include procurement, performance, and payment records. These include:
- Needs analysis
- Preparation and drafting of contract specifications
- Pre-qualification lists
- Requests for bids or proposals and responses
- Contracts and purchase orders
- Contractor’s work product
- Contractor’s invoices and supporting documents
- Checks, wire transfer or other payment records
- Correspondence and memoranda
- Email and computer files, including deleted files, which are recoverable through forensic software
Pay particular attention to the following:
- Do the suspect contracts or purchase orders contain audit clauses, which allow the victim organization to access the books and records of the contractor? This is quite important to identify corrupt payments
- Identify the bank account to which the suspect contractor was paid. This is often listed in the contract or is available from the payment office. This will be useful to trace funds if audit rights or subpoenas are available
- Examine bid securities and manufacturers certificates and check with the purported issuers to see if the documents are legitimate if questions arise
- Look for e-mail, telephone, fax or other communications or meetings between the suspect contracting employee and the contractor during the drafting of the bid specifications and prior to award
Records Related to the Suspect Contractor
These again depend on the allegations, but usually include:
- Records of prior work or contracts
- Prior complaints, audit and investigative reports
- Purchasing and pricing histories
Purchasing and pricing histories might reveal dramatic increases in prices or the volume of purchases from the suspect contractor. Compare the amount of work done for the victim organization with the total sales volume reported to Dun & Bradstreet or another business reporting agency. If a substantial percentage, the victim organization will have considerable leverage to compel the cooperation of the contractor in an investigation.
Records Related to the Suspect Official
Internal files that might contain helpful information regarding the suspect official include:
- E-mail (comply with proper access procedures)
- Computer hard drives and disks
- Hard copy correspondence files
- Telephone records
- Fax logs, transmission and receipt records
- Visitor and mail logs, including private delivery services (Fed Ex, DHL, etc.)
- Voice mail box records
- Annual Conflict of Interest and Financial Disclosure Forms
- Prior audit or investigation reports
- Employment Applications and Personnel Records
The above documents may include the following information that can provide leads to locating assets and potential witnesses:
- Date and place of birth
- US Social Security Number (SSN) or Civil Identification Number from other countries
- Previous employers
- Education
- References
- Current and prior residence addresses
- Name of spouse & other dependents
The first three digits of a US SSN identify the place of issue and other numbers identify the time period the card was issued. This information, plus the place of birth, places of education and prior employment, can show where the subject has lived and has family, and help focus public record searches and other background checks. Hidden assets might be in the names of spouses or dependents; ex-spouses could be potential witnesses.
Payroll Records
These are useful to:
- Identify the subject’s primary bank account, from which other accounts might be identified through deposits and transfers
- Compute a salary history to prepare a net worth or source and application of funds analysis and determine legitimate levels of expenditures; see Step Seven, below
Travel and Expense Reports
In addition to tracking the movements of a subject, travel and expense records can identify credit cards or bank accounts used by the subject. Hotel receipts might include telephone numbers called by the subject that could reveal undisclosed banking relationships, leads to hidden assets, associates or new witnesses. Gaps in travel records or reimbursement requests might indicate that contractors are paying for upgraded travel arrangements (a common tactic), or travel to sites the subject does not want known.
Other potentially useful internal records include:
- Job performance evaluations, promotions and disciplinary notices
- Liens and garnishments by state taxing authorities
- Prior complaints, audit or investigative reports. These reports might contain leads to witnesses or reveal prior incidents and methods of fraud;
- Current and prior organization charts. Look for subordinate employees who were present during the suspected offenses but who have since left.
Relevant Information in Corruption Cases
Look for evidence of corruption that might be available in internal documents or known to internal witnesses, such as:
- Unjustified favorable treatment of the suspect contractor by the suspect project officials
- The receipt of gifts and favors by project officials
- Close socialization by the official and contractor
- Indications of improper communications (e.g., emails) between bidders and project officials
- Indications of financial problems, or accumulation of sudden wealth, by the official
Favorable treatment of a contractor often is reflected in the “SPQQD” factors, which are present in many corruption cases involving procurement:
(S) Selection: Improper selection through improper sole sourcing or some other bid rigging mechanism;
(P) Price: Unexplained high prices to cover the cost of bribes and inflate profits;
(Q) Quantity: High number of contracts, or a high volume of purchases, from the company to increase the funds available for kickbacks and inflate profits;
(Q) Quality: Delivery and acceptance of low quality goods or services to reduce the contractor’s costs and increase profit margins to fund bribes and inflate profits;
(D) Delivery: Late, short or non-delivery of contracted goods works or services; deliveries do not match contract specifications.
Be sure to connect the SPQQD transactions to the suspect official, e.g., show that the official was involved in or responsible for the abuses or ignored them when they came to his or her attention.
Relevant Information in Fraud Cases
Collect the documentation that might contain the fraudulent representations or forged instruments, such as bids or proposals, bid securities, reports and other written work product, change order requests, test and inspection results and invoices and supporting documents. Examine the documents for evidence of falsity, such as discrepancies between invoices and the supporting documents.
More conclusive proof of falsity usually must be collected from external witnesses and documents, as described in Steps Six to Eight below.
Interviews of Subordinates of the Suspect Officials in Corruption and Fraud Cases
Interviews of subordinates of the suspect official generally are the most productive. Such witnesses are in the best position to observe the actions of the suspect official and often can provide good evidence of knowledge and intent; for example, the official may direct his or her subordinates to ignore standard procurement rules in order to assist a favored bidder or ignore complaints from them that such actions are improper.
Use organization charts or preliminary interviews to identify the relevant subordinates or assistants, including those that were employed during the critical time periods but have since left. Former employees might have left because of the misconduct, and may be more cooperative since they no longer fear retaliation.
To overcome the natural reluctance of witnesses to provide sensitive information about their bosses or co-workers, and to reduce the risk of rumors spreading after the interview, focus the questioning, at least initially, on suspect transactions rather than suspect individual. If the case involves, for example, the award of a questionable contract, start by asking questions about problems with the contract rather than about suspicious conduct by the employee who signed it. Eventually the questions will cover all the points and reach all the individuals involved.
Questioning about Statements by the Subject
When questioning a witness about his or her conversations with the subject, insist that the witness recite, to the extent possible, what was actually said by each party, not what was “talked about.” Find out when and where the conversation occurred, who was present, whether a note or memo was prepared, and about how long the conversation lasted (to see if you have covered everything).
Be sure to inquire about any conversations or communications the witness had with the subject, and any notes or memos that reflect them. Subordinates that were unwillingly involved in wrongdoing – for example, instructed to improperly sole source a contract – often keep records of such conversations to protect themselves.
It might help to have the witness sign an agreement to keep the interview confidential, although typically word of the investigation spreads quickly after such interviews despite such agreements.
Timing of the Interviews
Usually the early interviews are limited to witnesses who are not involved in the wrongdoing and are unlikely to notify the subject. If a subject is already aware of the investigation, however, or insists on being interviewed, an early interview can be useful. See step nine for more information. The realistic objectives of an early interview of the subject include:
- Learning the subject’s defenses. Allow the witness to fully present his version of the events and draw out the pertinent details: for this purpose, do not interrupt or challenge the subject on statements that you believe to be untrue; instead ask for more detail to assist you in showing later that the statements are false;
- Getting basic information about the subject’s financial condition – income, assets, liabilities, sources of cash, etc. – to lay the foundation for a financial investigation. Request relevant financial or other record, and remind the subject, if a current employee of the investigating organization, of his or her fiduciary duty to cooperate.
The interview of a subject should be recorded or transcribed, if feasible, or the subject should review and sign the memo of interview. This is because the subject’s knowing and willful false statements can be used to show fraudulent intent. Interviews of cooperative, disinterested witnesses generally do not have to be recorded.