Inquiring Minds: Building an Investigative Team

To build an effective investigative team, CSOs need to assemble the right mix of specialized talents. Then they have to cultivate trusting relationships with other organizational leaders.

The managing executives were concerned. The family-owned company they had acquired recently in a multimillion-dollar deal did not appear to be as profitable as they had expected. Threats had been made against their recently installed executive team, and an employee had come to them, in confidence, with a startling revelation: I think you're being bugged.

On behalf of the new ownership, Chris Marquet's investigations agency dispatched a team of 10 investigators and forensic accountants to do a little digging. The story they uncovered was worthy of a Robert Ludlum potboiler.

Under the purchase agreement, the new owners agreed that the founding family would remain in charge of the company's day-to-day management. A covert investigation of the family unearthed some interesting facts, such as the prior arrest of one family member on weapons and drug charges.

Even more disturbing, forensic accountants determined that the family had been using the company as their personal piggy bank. Corporate funds had financed homes, boats, cars, vacations and a number of other luxury items. Inventories, receivables and reserves had all been misstated to enhance the value of the company, and a cleverly designed computer program had defrauded customers by overcharging a small amount on each transaction at the point of sale. Fearful of discovery, the family was thought to be eavesdropping on the new management team. Interviews of current and former employees yielded a trove of other alleged crimes and misdemeanors, everything from sexual harassment and discrimination to suspicions of ties with organized crime.

"It was a can of worms, and it kept getting bigger," says Marquet, executive managing director and a founding principal of Citigate Global Intelligence & Security. Marquet says the investigation took place some years ago, before he formed Citigate, and he declines to name his client and the subjects of his inquiry. He says the five-month long investigation culminated in the firing of the family patriarch and three other family members, criminal charges being filed and a civil suit, the outcome of which enabled the company to recoup some of the estimated $5 million that it had overpaid for its acquisition. And in firing the family, the company was no longer obligated to pay out their hefty five-year contracts.

Few CSOs will ever have to oversee an investigation of this magnitude. Background checks, off-color e-mails and expense report cheats will compose a far greater percentage of an investigative team's caseload than will checking out surreptitious eavesdropping and alleged criminal activities. However, seasoned corporate investigators agree that regardless of the size and scope of a case, the core competencies of a good investigator and a well-managed investigation are largely the samethough by no means simple to master.

"It's an art form to be able to maneuver your way through some cases," notes Thomas Nihill, a former special agent for both the IRS Criminal Investigation Division and the U.S. Department of Labor's Organized Crime and Racketeering Section, and now the managing principal of Nihill & Riedley forensic accounting firm.

We spoke with security executives, forensic accountants and corporate investigators, and uncovered their best practices and techniques for building a strong investigative unit and for successfully managing an investigation. Like any management skill, CSOs need to exercise their communication and leadership skills with investigators. Unlike other security professionals, however, corporate investigators are a specialized breed, and assembling a first-rate team requires cultivating members with a variety of singular skills. Some need the technical savvy to pick through financial and computer records. Others possess a sensitivity to human behavior. All share a healthy respect for organization and process, however, and demonstrate the hallmark trait of all great detectives: dogged determination.The Sensitive Side of Security Building an investigative unit is not like erecting a new perimeter fence. It requires finesse and sensitivity. Investigations make people nervous. This is especially true in the corporate world where people worry about losing their jobs and nobody wants to be responsible for causing a fellow employee to lose his. That means that when questions come up, it's important to understand how those questions are perceived by the people who are giving answers.

This is true even in situations where there's not an investigation per se, merely a quest for information. Take one of the security executives we spoke with, who once received a phone call from a satellite office in South America. Employees there were concerned that an investigation was under way regarding cell phone usage. In reality, there was no investigation. The company was looking at ways to cut costs and eyeing cell phone bills. The process of doing so, however, stirred concern among employees who feared the I-word. (Employees calmed down once they heard it was a budget review.)

CSOs with experience building an investigative team say it's imperative to be sensitive to employees' perceptions, as well as cultural differences among far-flung employees working around the globe.

"Investigations have to be conducted with integrity and respect for individuals," says Ed Casey, chief security officer at Procter & Gamble. "You're making a judgment about someone's career, and that can create serious credibility problems for the security organization if it's not done properly. There have been many occasions where an employee is terminated by a company, and the employee has filed suit and been awarded damages because the process wasn't right."

Many investigators come to the corporate world from a career in law enforcement. This affords them an extensive knowledge of investigative techniques but little experience in navigating the rocky shoals of corporate politics. Many corporate investigations are hobbled before they even start because security takes an overly aggressive posture within the organization. Not only does this expose the company to liability, it also discourages would-be whistle-blowers and witnesses from coming forward and sharing what they know.

Most frauds are reported by other employees, says Carl Pergola, national director of FirstGlobal Investigations, a division of BDO Seidman. Pergola says that "if you approach employees with a condescending or intimidating style, your first line of defense is unavailable to you."

"Besides," Pergola adds, "there's always an opportunity to intimidate someone [later] if you need to."Diverse Experiences WantedOutside of Sherlock Holmes' lair at 221B Baker St., it's practically impossible to find a single individual who possesses all the skills that many corporate investigations will require. The best approach is to build a team of investigators with a broad spectrum of talents and experiences.

Many companies hire ex-law enforcement officers for their years of investigative experience. These individuals are often experts in interview techniques (see "Inside the Interview Room," opposite page) and in documenting and tracking a case's progress. Many companies also round out their investigative unit with experts in computer forensics who can locate and preserve evidence that exists within a computer or the corporate network. They also look for forensic accountants who have a keen understanding of accounting principles and the particular business processes of their employer so that they can recognize irregularities.

At Boise Cascade, CSO Jim Ashby recalls one situation where ghost employees at several branch offices were entered into the payroll system at the paper and construction product maker. The person responsible for the fraudulent payroll records collected more than $250,000.

During the early stages of an in-house investigation, the diversion of money hadn't seemed possible because there was traditionally a separation of duties between the person who created new employee records in the payroll system and the individual who sent staffing reports to each location. But after the diversion of money had gone on for some time, Boise Cascade investigators finally figured out that one person had changed jobs several times but had retained the ability to create and edit new employee entries, and had later deleted the "ghosts" before any reports could alert management. Although the perpetrator and spouse had already spent much of their ill-gotten gains prior to being brought to court, the judge ordered restitution, and the pair pleaded guilty to federal charges and were sentenced to multiple years in prison, Ashby says.

While Ashby's team had the skills to solve that case, some companies may wish to outsource some or all of their investigations to a vendor that has the full range of capabilities instead of building their own unit. This is especially critical for companies that routinely deal with investigations that are international in reach. The cultural issues and conflicting legal systems that come into play when dealing with an employee or business partner based outside the United States can flummox even the most seasoned investigator.

Prior to joining Kimberly-Clark, where he is a senior regional security manager, John Rodriguez worked as an independent consultant and participated in more than 200 investigations in Latin America. Rodriguez suggests looking for an investigator who possesses cultural sensitivity. He points out that in some Latin American countries, the simple act of interviewing a subject in a closed room could be viewed as illegal detention or kidnapping. In some pro-labor countries, employees have a lesser threshold of proof for defamation or wrongful-termination. A skilled interviewer can neutralize such risks, Rodriguez says.

Whether you choose to use an internal or external investigator, Rodriguez suggests focusing on one "who has the right skill set for that country, and a holistic understanding and experience of the country and the region that he is going into."Those Intangible QualitiesIn addition to learned skills, a crack investigator possesses some intangible qualities. The first is objectivity. This is especially important in corporate life, where investigations can reach up into the executive suite or down among friends and coworkers. Part of remaining objective is ensuring that the scope of your investigation isn't narrowed prematurely. Often the real problem will turn out to be something different from what was originally suspected or the first report will be just the tip of a larger concern.

"We investigated an incident where a worker in a manufacturing plant finally came forward [after months of intimidation] when a coworker threatened to kill him," says Tim Dimoff, CEO and president of SACS Consulting. "After some investigation, it turned out that four more people had been threatened by that same individual in the past six months." Dimoff says his company posted an armed security guard to protect fearful employees, then notified the worker making the threats about the investigation; the worker left soon after and found another job.

Second, investigators require an inquisitive mind. "Some people are better wired for this than others," says Fabian Campion, manager of business risk mitigation and investigations at 3M. "An inquisitive mind means not taking things at face value, not taking 'no' for an answer and constantly asking why." Investigators also have to be able to deal with the potential consequences of their job. "I've worked with some folks who have such good analytical skills," says Boise's Ashby, "but they can't deal with being the person who causes someone to lose their job or be disciplined. They can't ask questions knowing that they're going to get someone in trouble. Not everyone is cut out for this."

1 2 Page 1
Page 1 of 2
7 hot cybersecurity trends (and 2 going cold)