Remote Investigation: Corporate Fraud Investigation in India

While making a decision to defer an investigation, it may be considered to prioritise matters with impeding harm (to employees/other individuals) or with legal, regulatory, reputational, or severe financial consequences. Allegations alluding to pervasive issues or continuing irregularities, or instances where delays may compromise evidence or witnesses, may need to be promptly addressed. Effectiveness of remote investigation procedures and interviews may also be evaluated on a case-by-case basis while making this decision. If a decision is made to defer an investigation, it is important to secure and preserve data and evidence to the maximum extent possible and implement interim measures or controls to stop the alleged malpractice. The situation should also be monitored to identify matters, such as continuing allegations and possible regulatory scrutiny, necessitating reprioritisation.

Undertaking investigations remotely requires considerably greater planning and co-ordination amongst the investigation team. Case Management Systems and collaboration tools are great ways to keep the investigation on track with the entire team apprised of progress and observations.

In the planning stage, it is critical to identify information sources and pre-empt collection challenges to devise alternative solutions. Informational interviews and process discussions can be conducted over virtual meeting platforms, while process walkthroughs could be conducted live over video. Data extraction may be conducted using remote access and data/documentation may be exchanged on secure file sharing platforms. Hard copy documentation may be digitised. However, the originals may need to be preserved.

Forensic imaging of user devices, such as laptops and desktops, may no longer be feasible without requiring the physical presence of the custodian. Most organisations nowadays backup employee emails and user data to their cloud storage and are able to facilitate data retrieval for investigations. Enterprise collection software allows for remote imaging of devices connected to the office network for the required duration. In an open investigation with a cooperative custodian, a hard disk drive with pre-loaded scripts may be used for imaging—the user would just need to plug in the device and press a button.

Intelligence gathering procedures from desktop searches, including adverse media, corporate filings, litigation databases, creditworthiness checks, social-media mapping, regulatory checks (bankruptcy/insolvency, international watch lists, etc.), and telephonic source enquiries remain unaffected.