Take not of this question for your CA You are a manager in the forensic auditing investigation department of the audit firm. The directors of a local manufacturing company, MSc 2 Ltd, have contacted your department regarding a suspected fraud, which has recently been discovered operating in the company, and you have been asked to look into the matter further. You have held a preliminary discussion with Segun Peter, the finance director of MSc 2 Ltd, the notes of this conversation are shown below:
Notes of discussion with Segun PeterFour month ago MSc 2 shut down one of its five factories, in response to deteriorating market conditions, with all staff employed at the factory made redundant on the date of closure.
While monitoring the monthly management accounts, Segun perform analytical procedures on salary expenses. She found that the monthly total payroll expenses has reduced by 3% in the months following the factory closure-not as much as expected jilven that 20% of the total staff of the company has been made redundant. Initial investigation performed last week by Segun revealed that many of the employees who had been made redundant had actually remained on the payroll records, and salary payments in respect of these individuals were still being made every month, with all payment going into the same bank account. As soon as she realised that there may be a fraud being conducted within the company, Segun stopped any further payments in respect of the redundant employees. He contacted our firm as she is unsure how to proceed, and would like our firm‘s specialised department to conduct an investigation.
Segun says that the senior accountant, Akeem Bello, has been absent from work since he conducted his initial investigation last week, and it has been impossible to contact him. Segun believes that he may have been involved with the suspected fraud.
Segun has asked whether your department would be able to provide a forensic investigation, but is unsure what this would involve. MSc 2 is not an audit client to your firm. As a forensic expert, what are you going to do
The Correct Answer and Explanation is:
Here is a detailed and professional response to the question based on your role as a forensic audit manager investigating suspected payroll fraud at MSc 2 Ltd:
As a forensic expert, what are you going to do?
As the manager in the forensic auditing investigation department, my approach to the suspected payroll fraud at MSc 2 Ltd will follow a structured and methodical forensic investigation process. The primary objective is to uncover the facts, quantify the financial loss, identify the individuals involved, and provide evidence that can support legal or disciplinary actions if necessary. The investigation will be executed with strict adherence to ethical guidelines, objectivity, and legal protocols.
1. Initial Engagement and Understanding the Case
The first step is to confirm the scope of the engagement with MSc 2 Ltd through a formal engagement letter. This letter will outline:
- The purpose of the investigation (to investigate suspected payroll fraud).
- The scope of work to be performed.
- Roles and responsibilities.
- Timelines and deliverables.
- Fees and billing arrangements.
- Confidentiality agreements.
Because MSc 2 Ltd is not an audit client of the firm, there is no threat to independence in taking up this forensic assignment. However, the engagement must be treated as a separate non-audit service.
2. Planning the Forensic Investigation
I will assemble a team of forensic accountants with experience in payroll systems and fraud investigations. The team will develop an investigation plan, which includes:
- Identifying key personnel to interview.
- Accessing relevant documentation (e.g., payroll records, redundancy notices, bank transfer records).
- Setting timelines and prioritizing investigative procedures.
- Assessing the risk of data tampering or destruction.
The planning phase will also include preserving the integrity of digital and physical evidence, potentially with the assistance of digital forensic experts to clone relevant systems and secure data logs.
3. Understanding the Payroll Process
To determine how the fraud was committed, we must understand the payroll process at MSc 2 Ltd, including:
- How employee termination is processed.
- Roles and responsibilities in payroll authorisation and payment.
- How changes in employee records are made and who has system access.
- The control environment and any known weaknesses.
We will obtain the payroll system access logs, audit trails, and process flowcharts to evaluate segregation of duties and detect potential override of controls.
4. Conducting Detailed Forensic Testing
We will perform the following forensic procedures:
- Data Analysis:
- Compare pre- and post-redundancy payroll reports to identify anomalies.
- Identify “ghost employees” (redundant employees who remained on payroll).
- Match employee bank accounts with payment records to trace the flow of funds.
- Look for multiple payments to the same bank account or to accounts with suspicious patterns.
- Substantive Testing:
- Reconcile the number of actual employees to the number being paid.
- Verify redundancy documentation and cross-check against payroll.
- Check for any approvals made under Akeem Bello’s credentials.
- Trend Analysis:
- Analyze salary expense trends over several months before and after the factory closure.
- Compare actual vs. expected payroll reductions based on redundancy percentages.
5. Interviewing and Gathering Evidence
Interviews will be conducted with key personnel including:
- Segun Peter (Finance Director) – for context and initial findings.
- HR personnel – to verify redundancy records.
- Payroll clerks – to understand who processed payments and any anomalies noticed.
- IT personnel – to assess system access controls and logs.
- If located, Akeem Bello – to understand his role and obtain a response to the allegations.
All interviews will be documented, and where appropriate, formal written statements may be obtained.
6. Involvement of Legal and Law Enforcement Agencies
If evidence suggests that a crime has been committed, we will advise MSc 2 Ltd to notify law enforcement authorities. We will also advise them to consult with their legal counsel to ensure proper legal procedures are followed and that the evidence we gather is admissible in court, should they pursue prosecution or civil action.
7. Reporting and Recommendations
At the conclusion of the investigation, we will provide a detailed forensic investigation report, which will include:
- Executive summary of findings.
- Detailed analysis of how the fraud was perpetrated.
- Individuals involved and timeline of fraudulent activities.
- Quantification of financial losses.
- Supporting documentation and evidence.
- Weaknesses in internal controls identified.
- Recommendations for remediation and control enhancements.
- Suggested disciplinary, legal, or criminal proceedings, if applicable.
Explanation and Justification
The role of a forensic auditor in fraud investigations is to establish the facts objectively, identify perpetrators, quantify losses, and recommend control improvements. In this case, MSc 2 Ltd has identified significant discrepancies in payroll expenses following the redundancy of 20% of its workforce, which indicates a likely payroll fraud.
Professional skepticism must guide the investigation, particularly because a key suspect (Akeem Bello) is absent without explanation. The initial findings show redundant employees are still being paid, and those payments are being funneled into a single bank account, which is a major red flag for fraudulent activity. The use of a common bank account for multiple salaries suggests that someone manipulated payroll records to divert funds after the factory closure.
Securing evidence early is crucial to prevent destruction or tampering. Digital forensics experts will assist in extracting data logs, emails, and access records without altering metadata. Chain-of-custody documentation will be maintained for all physical and digital evidence.
A comprehensive understanding of MSc 2 Ltd’s payroll system will be essential to pinpoint process gaps or override of controls. Understanding who had access to terminate employees and update records can clarify how the fraud was enabled.
Data analytics will play a key role in detecting unusual patterns, such as duplicate bank account numbers or inconsistencies in employee status. For example, an employee marked “terminated” in HR records but still present in payroll suggests a system manipulation.
Interviewing staff underpins the investigation. The approach will be non-accusatory and fact-finding in nature, with a focus on clarity and neutrality. We will follow best practices, including informing interviewees of their rights and taking detailed notes or recording interviews with consent.
Legal implications must be considered throughout. Our team will ensure the investigation follows local regulations and that all findings are admissible in a court of law. Privacy, data protection, and labor laws must be respected during the investigation.
The reporting phase will deliver actionable insights. In addition to identifying the fraud, our recommendations will help MSc 2 Ltd strengthen internal controls to prevent recurrence. These may include:
- Improved segregation of duties in payroll processing.
- Periodic independent reconciliation of HR and payroll records.
- Mandatory dual authorization for payment changes.
- Enhanced audit logging and monitoring of access to sensitive systems.
- Regular internal audits of payroll transactions.
Finally, our investigation may support disciplinary actions, insurance claims, or criminal prosecutions. If needed, we will provide expert testimony and collaborate with lawyers or prosecutors.
Conclusion
This forensic audit investigation is not just about uncovering the fraud—it’s also about rebuilding trust and systems within MSc 2 Ltd. By applying a structured, evidence-based approach and maintaining professional integrity, we will help the company recover from the incident and strengthen its internal control environment.
