You are a manager in the forensic auditing investigation department of the audit firm. The directors of a local manufacturing company, MSc 2 Ltd, have contacted your dregarding a suspected fraud, which has recently been discovered operating in the company, and you have been asked to look into the matter further. You have held a preliminary discussion with Segun Peter, the finance director of MSc 2 Ltd, the notes of this conversation are shown below:Notes of discussion with Segun PeterFour month ago MSc 2 shut down one of its five factories, in response to deteriorating market conditions, with all staff employed at the factory made redundant on the date of closure.
While monitoring the monthly management accounts, Segun perform analytical procedures on salary expenses. She found that the monthly total payroll expenses has reduced by 3% in the months following the factory closure-not as much as expected jilven that 20% of the total staff of the company has been made redundant. Initial investigation performed last week by Segun revealed that many of the employees who had been made redundant had actually remained on the payroll records, and salary payments in respect of these individuals were still being made every month, with all payment going into the same bank account. As soon as she realised that there may be a fraud being conducted within the company, Segun stopped any further payments in respect of the redundant employees. He contacted our firm as she is unsure how to proceed, and would like our firm‘s specialised department to conduct an investigation.
Segun says that the senior accountant, Akeem Bello, has been absent from work since he conducted his initial investigation last week, and it has been impossible to contact him. Segun believes that he may have been involved with the suspected fraud.
Segun has asked whether your department would be able to provide a forensic investigation, but is unsure what this would involve. MSc 2 is not an audit client to your firm. As a forensic expert, what are you going to do
The Correct Answer and Explanation is:
As a forensic expert and manager in the forensic auditing investigation department, my role is to undertake a systematic and thorough investigation into the suspected fraud at MSc 2 Ltd. Given the information provided by the finance director, Segun Peter, it appears that a payroll fraud has been committed, where redundant employees’ salary payments were fraudulently continued and directed into a single bank account — possibly by an insider, potentially Akeem Bello, the senior accountant.
✅ Correct Course of Action
- Engagement Acceptance and Scoping
- First, I would formally accept the engagement after ensuring that our firm has no conflict of interest.
- Since MSc 2 is not an audit client, independence requirements for audit assurance are not strictly applicable, but ethical standards such as objectivity, confidentiality, and integrity must still be adhered to.
- I would clearly define the scope and objective of the forensic investigation in an engagement letter, including responsibilities, timeline, and fees.
- Initial Planning and Risk Assessment
- Assemble a forensic investigation team with expertise in payroll, financial systems, and digital forensics.
- Conduct an initial risk assessment to understand the nature, extent, and potential financial impact of the suspected fraud.
- Review the timeline of the fraudulent activity, i.e., from the closure of the factory (four months ago) to the present.
- Evidence Gathering
The next step involves gathering and preserving evidence systematically and legally, ensuring its admissibility in court if needed.- Obtain and examine the payroll records from the past 12 months.
- Identify all employees listed as redundant from the closed factory.
- Review the payment trail — bank transfer records, including recipient names, bank account details, and payment authorization records.
- Use data analytics to identify duplicate bank accounts, abnormal payment patterns, or fake employee identities.
- Identify who had access and authority to make changes to the payroll system — system logs can help trace logins, modifications, and approvals.
- Digital Forensics and Email Review
- If suspected, perform a digital forensic examination of Akeem Bello’s work computer, email accounts, and access logs.
- Look for emails or files suggesting collusion or intent, such as spreadsheets of payroll manipulation or communication with banks.
- Work with IT to recover deleted files, if applicable.
- Interview Key Staff
- Conduct formal interviews with:
- HR department (to verify redundancy lists),
- Payroll officers and junior accountants,
- Supervisors from the closed factory (to confirm which staff were made redundant),
- Akeem Bello (if he can be located), and
- Segun Peter (for clarification on actions taken).
- Interviews are non-accusatory in nature and follow structured forensic protocols.
- Conduct formal interviews with:
- Assess Internal Controls
- Evaluate the internal control weaknesses that allowed the fraud to occur and continue undetected.
- Assess:
- Whether access rights were properly revoked after redundancies.
- How payment authorizations were handled.
- Whether segregation of duties was maintained.
- Quantify the Fraud
- Calculate the total financial loss resulting from the fraudulent salary payments.
- Determine the duration and number of fraudulent transactions.
- Report Writing
- Prepare a clear, structured forensic report including:
- Executive summary
- Background and scope of the investigation
- Methodology
- Findings and supporting evidence
- Individuals potentially involved
- Impact assessment (financial, operational, reputational)
- Internal control weaknesses
- Recommendations for recovery and prevention
- Ensure that the report is suitable for potential legal proceedings or law enforcement.
- Prepare a clear, structured forensic report including:
- Liaison with Legal Counsel
- If the evidence confirms a criminal offense, advise MSc 2 Ltd to:
- Report the matter to the police or Economic and Financial Crimes Commission (EFCC).
- Pursue legal action to recover funds and prevent future occurrences.
- Collaborate with their external legal counsel as needed.
- If the evidence confirms a criminal offense, advise MSc 2 Ltd to:
- Recommend Preventive Measures
- Propose enhanced internal controls such as:
- Regular payroll audits.
- Dual approval for payroll changes.
- Use of unique employee IDs.
- HR/payroll system integration to prevent unauthorized entries.
- Access control and monitoring logs.
- Suggest fraud awareness training for finance staff.
🔍 Key Concepts and Issues in This Case
1. Payroll Fraud
Payroll fraud typically involves manipulation of salary records to divert funds. In this case, the ghost employee fraud type is evident: salaries are paid to individuals no longer working for the company, and the funds are diverted to one or more accounts controlled by the perpetrator.
2. Red Flags
- Discrepancy between expected and actual reduction in payroll costs.
- Multiple payments to a single bank account for different employees.
- Unexplained absence of a senior finance staff member after discovery.
3. Segregation of Duties
Proper controls would have required:
- HR to initiate terminations.
- Payroll to remove employees based on HR inputs.
- Finance to authorize payments.
- Lack of segregation may have allowed one individual (e.g., Akeem Bello) to create, authorize, and conceal fraudulent payroll entries.
4. Corporate Governance
The board of directors must be kept informed of the investigation. The case also highlights a failure in governance and oversight — especially the need for regular reconciliation and analytical reviews.
🧾 Ethical and Legal Considerations
- Confidentiality must be maintained throughout.
- Objectivity and independence must guide every step.
- Care must be taken not to make accusations without conclusive evidence.
- Evidence must be preserved properly to be admissible in disciplinary or legal proceedings.
- The findings may need to be disclosed to regulatory bodies depending on local legislation.
📘 Conclusion
In conclusion, as the forensic investigation manager, I would proceed by formally accepting the engagement, carefully scoping the investigation, and using a combination of digital forensic tools, document analysis, interviews, and data analytics to uncover the full extent of the suspected fraud. I would aim not only to identify the perpetrators and quantify the loss but also to strengthen MSc 2 Ltd’s control environment and prevent recurrence.
A structured forensic report would be delivered, potentially supporting legal action or disciplinary procedures, and guidance provided for system improvement. Ultimately, the objective is to uncover the truth, safeguard company assets, and restore integrity to internal financial processes.
