By Kyle Condon

Fraud rarely announces itself with flashing warning lights. More often, it begins quietly—an unexplained payment, a stock variance that cannot be reconciled, a supplier relationship that feels unusually close, or an employee whose lifestyle appears inconsistent with their earnings. Knowing when to open a formal internal fraud investigation is one of the hardest judgement calls management faces.

Many organisations make the mistake of dismissing these early indicators as administrative errors, isolated incidents, or simple misunderstandings. Unfortunately, by the time the true extent of the problem is uncovered, financial losses can be substantial, and damage to the organisation’s reputation, culture, and stakeholder confidence may already be done.

One of the most common questions asked by directors, business owners, and senior managers is:

“At what point should we move beyond suspicion and initiate a formal fraud investigation?”

The answer is simple: the moment credible indicators suggest that misconduct may have occurred, and management can no longer confidently explain the irregularity through normal business processes.

In this article, we explore the warning signs that justify a formal internal fraud investigation, why delaying action can be costly, and how organisations can protect themselves through a structured forensic approach.

Understanding Internal Fraud

Internal fraud occurs when an employee, manager, executive, contractor or trusted business associate deliberately abuses their position for personal gain or to benefit another party.

Fraud can take many forms, including:

• Procurement fraud
• Invoice manipulation
• Payroll fraud
• Theft of stock or assets
• Falsification of financial records
• Expense claim fraud
• Bribery and corruption
• Tender irregularities
• Conflict of interest violations
• Business email compromise schemes
• Unauthorised payments
• Supplier collusion
• Ghost employees

Detecting and proving these schemes is the core of corporate business investigations. The challenge facing management is that fraudsters often understand company systems extremely well. They know where controls are weak, where oversight is lacking, and how to conceal their activities for extended periods.

The Cost of Waiting Too Long

One of the greatest mistakes management can make is waiting for “absolute proof” before taking action.

Fraud investigations should not begin once guilt has already been established. They should begin when credible concerns exist that require verification.

Waiting too long often results in:

• Continued financial losses
• Destruction of evidence
• Witness contamination
• Data deletion
• Expansion of the fraud scheme
• Increased legal liability
• Reputational damage
• Reduced prospects of recovery

Experienced fraudsters frequently become more sophisticated over time. Every month that passes without intervention may allow additional losses to occur.

Key Warning Signs That Justify a Formal Internal Fraud Investigation

1. Unexplained Financial Irregularities

Financial discrepancies remain one of the strongest indicators that a formal investigation may be necessary.

Examples include:

• Unexplained cash shortages
• Missing deposits
• Unusual journal entries
• Duplicate payments
• Supplier overpayments
• Significant budget variances
• Unauthorised expenditure
• Missing supporting documentation

While mistakes can occur in any organisation, repeated or unexplained irregularities should never be ignored. If management cannot obtain a satisfactory explanation through normal enquiry processes, an independent forensic audit investigation should be considered.

2. Lifestyle Red Flags

Lifestyle audits remain one of the most effective tools available to investigators.

Whilst wealth alone does not indicate wrongdoing, organisations should take notice when employees appear to be living significantly beyond their legitimate means.

Potential warning signs include:

• Luxury vehicles
• Expensive holidays
• Significant property acquisitions
• Excessive gambling activity
• Unexplained cash spending
• Sudden displays of wealth

When combined with access to financial processes, procurement functions, or payment authorisation authority, these indicators may warrant further investigation.

3. Anonymous Whistleblower Reports

Many major fraud cases begin with information received from employees. Whistleblowers often possess knowledge that management cannot easily access.

Unfortunately, some organisations dismiss anonymous reports because the source is unknown. This can be a costly mistake.

A whistleblower allegation does not automatically prove misconduct, but it frequently provides sufficient grounds to initiate a preliminary fraud assessment. The focus should always be on verifying the information rather than dismissing it.

4. Procurement and Supplier Concerns

Procurement fraud continues to cost South African companies millions of rand annually.

Management should be alert to indicators such as:

• Repeated use of the same supplier
• Supplier relationships lacking transparency
• Prices significantly above market rates
• Unexplained contract awards
• Split purchase orders
• Conflicts of interest
• Undisclosed relationships between staff and suppliers

Where procurement concerns cannot be reasonably explained, a formal investigation should be considered before losses escalate further.

5. Inventory and Stock Losses

Stock losses are often incorrectly attributed solely to operational inefficiencies.

In reality, shrinkage frequently involves:

• Internal theft
• Supplier collusion
• Receiving bay fraud
• Warehouse manipulation
• Inventory record manipulation
• Organised criminal activity

When stock losses exceed expected operational tolerances or continue despite corrective measures, management should investigate the possibility of deliberate misconduct.

6. Manipulation of Company Records

Employees involved in fraud often leave traces through document manipulation.

Examples include:

• Missing invoices
• Altered documentation
• Backdated approvals
• Deleted emails
• False quotations
• Fabricated supporting records

Any indication that company records may have been intentionally altered should trigger immediate scrutiny. The longer organisations delay, the greater the risk that evidence may be permanently lost.

7. Resistance to Oversight

One of the most overlooked fraud indicators is unusual resistance to supervision.

Potential warning signs include employees who:

• Refuse to take leave
• Resist audits
• Avoid delegating responsibilities
• Maintain exclusive control over processes
• Become defensive when questioned
• Restrict access to records

Whilst none of these behaviours proves fraud, they may indicate attempts to conceal irregular activities.

8. Information Obtained Through Undercover Operations

In high-risk environments such as retail, hospitality, logistics, and warehousing, companies increasingly rely on undercover investigations to identify theft and collusion.

Information gathered through:

• Undercover operatives
• Mystery shoppers
• Integrity testing
• Surveillance
• Internal intelligence sources

may provide sufficient grounds for a formal fraud investigation. Often, the purpose of the formal investigation is to convert intelligence into evidence that can support disciplinary action, civil recovery, or criminal proceedings.

What Should Happen Before the Investigation Begins?

Before launching a formal investigation, management should take three steps.

Preserve Evidence

Protect:

• Emails
• CCTV footage
• Access control records
• Financial data
• Mobile devices
• Company laptops
• Accounting records

Failure to preserve evidence can compromise the investigation.

Limit Internal Discussion

One of the most common mistakes is alerting potential suspects too early.

Premature disclosure may lead to:

• Evidence destruction
• Witness coaching
• Data deletion
• Collusion between suspects

Investigations should be conducted on a strict need-to-know basis.

Appoint Independent Specialists

Fraud investigations require specialised skills.

An independent forensic investigator provides:

• Objectivity
• Legal defensibility
• Interview expertise
• Evidence management
• Financial analysis capability
• Intelligence gathering capacity

Internal HR or line management teams are often not equipped to conduct complex fraud investigations effectively.

Why Independent Investigations Matter

An independent investigation sends a powerful message: the organisation takes integrity seriously.

At D&K Management Consultants, we regularly encounter situations where management suspected misconduct for months—or even years—before deciding to investigate. In many of these cases, the losses ultimately proved far greater than initially believed.

An independent investigation provides management with:

• Facts instead of rumours
• Evidence instead of assumptions
• Accountability instead of speculation
• Recommendations instead of uncertainty

Most importantly, it allows leadership to make informed decisions based on verified information.

Frequently Asked Questions

When should a company start an internal fraud investigation?

A company should start an internal fraud investigation the moment credible indicators suggest misconduct and management can no longer explain the irregularity through normal business processes. Waiting for absolute proof usually means waiting too long.

Do you need proof of fraud before investigating?

No. An investigation begins where credible concern exists, not where guilt is already established. Its purpose is to verify whether the concern is founded, preserve evidence, and establish the facts before losses escalate.

Why use an independent forensic investigator rather than internal HR?

Independent forensic investigators bring objectivity, legal defensibility, evidence-management discipline, and financial analysis capability that internal HR or line management teams are rarely equipped to provide in complex fraud matters.

What should management do before an investigation begins?

Preserve evidence, limit internal discussion to a strict need-to-know basis, and appoint independent specialists. Alerting suspects early or mishandling evidence can compromise the entire investigation.

Final Thoughts

Fraud thrives in environments where warning signs are ignored.

The question should not be: “Can we prove fraud today?” The better question is: “Do we have sufficient reason to investigate?”

When unexplained financial irregularities, procurement concerns, stock losses, whistleblower allegations, lifestyle red flags, or evidence manipulation begin to emerge, organisations should resist the temptation to dismiss them as isolated incidents.

A timely and professionally conducted internal fraud investigation can stop losses, identify those responsible, preserve critical evidence, and restore confidence in the organisation’s controls.

If management has reached the point where questions remain unanswered and concerns continue to grow, that is often the clearest indication that the time to investigate has already arrived. If your organisation is weighing that decision, contact D&K Management Consultants for a confidential discussion.