Fraud response plan

It is essential that evidence is preserved and retained securely, the following steps should be followed:

• remove all relevant original documents and store them securely. Record the date of removal, any noteworthy circumstances, and where they are stored. Replace documents needed for everyday use (e.g. till rolls and receipt books) with new ones to prevent unnecessary disruption to services. Original documents and certified copies provide the best evidence

• for computer systems, consider access rights, and change or suspend access to preserve evidence. (See below for more on ICT evidence)

• in all cases, take care not to compromise evidence by doing or allowing anything that may deface or alter the evidence, particularly in ways that may alter the evidential value (such as punching filing holes that chop out a date or signature)

• you must also take care that evidence is always secure, so that there is no opportunity for damage or changes. This is known as preserving the chain of evidence. If there is a break, such as leaving a document out on a desk unattended, it could compromise a prosecution

• where you have to use a copy, endorse it as a copy and, if possible, certify it (i.e. sign and date on the back) as a true copy of the original, preferably by the person who took the copy from the original source document. Use of copies is increasingly common with document management systems, where documents are scanned and then destroyed

• minimise handling of documents to protect forensic evidence, such as fingerprints. Put them in clear plastic wallets to protect them, and to avoid the need to punch filing holes in them. This avoids the possibility of damaging key pieces of evidence

• information held on IT equipment provides evidence of the records at a particular time and may demonstrate that a fraud has been committed. It is important that the IT equipment is secured as soon as possible. Please contact the Audit Manager for advice in relation to this. Any printouts of data and exception reports can be useful, so should be retained, these together with hard copies should be timed, dated and signed by the investigator

• suspend suspects and prevent their access to our buildings, remove their access rights to IT networks and systems and change all relevant passwords, PIN numbers etc.

• physical evidence is necessary when the investigation arises from an apparent discrepancy in cash, stores or other assets. A physical count of the cash, stores or assets is necessary to record the actual value of the cash/stores present at a fixed point in time

• all cash held by the person should be counted at the same time (to prevent the same cash being presented more than once to cover a shortage). The cash count should include a detailed analysis of cash by denomination and any cheques, receipts and IOUs. The count should be checked by two people and the results signed and dated by both

• ask the employee under investigation if there is any more cash (e.g. at their home) and check this immediately to prevent subsequent reinstatement

• all stocks and stores need to be counted if there is a suspicion of theft of assets. A full stock check, including opening all boxes to ensure they contain the goods they are supposed to, should be undertaken. Stock totals should be signed and dated by two investigators. If there are similar stores in other locations controlled by the suspect, then these need to be checked simultaneously to avoid stocks being moved between different stores to hide discrepancies

• observations can be used to identify exactly what is happening to physical assets (e.g. stores being loaded into private cars)

• seek guidance from Internal Audit before any surveillance, who will also consult our legal service. Surveillance must be necessary and proportionate in accordance with the Regulations of Investigatory Powers Act 2000 (RIPA) for localauthorities now to be able to undertake any surveillance authorisation must be sought from the magistrates court

• relevant CCTV footage may be available. In addition, if any form of access system is in use, it may establish who was where and when

• if videos are to be used in evidence they should have the date and time continuously displayed. For the same reasons as for IT equipment, preserve the original tape intact as evidence for possible use in court and disciplinary hearings. Make a copy of the video and only view the copy during the investigation