John W. Kennish, CPP - Security Consultant
62 East Pond Meadow Road, Westbrook, Connecticut 06498
(860) 399-8545
Kennish.com
E-Mail John Kennish
© 2006 John W. Kennish, CPP

 

Employee Theft: A Question of Integrity

I. The Problem

 1. Why Do Some Employees Steal From Their Employers?

   a. Opportunity

   b. Employee Attitudes

   c. Management Attitude

   d. Prevention and Control Measures

II. Internal Investigative Risks

 1. The Need For Internal Investigations

 2. Objectives of an Internal Investigation

   a. The Problem

 3. Investigative Pitfalls

   a. Defamation

   b. Assault

   c. False Imprisonment

   d. Invasion of Privacy

   e. Searches

   f. Malicious Prosecution

III.Investigation of Internal Loss Situations

 1. Loss Reporting Proces

 2. Need for Coordination

 3. Verify the Loss

 4. Investigative Process

 5. Interviewing

 6. Maintain Control

 7. Keeping After the Truth

 8. Legal Aspects

 


 

Employee Theft: A Question of Integrity

I. The Problem

The process of management is at best, a challenge. While business should be managed with skill and a vision for the future, problems involving people will inevitably arise. One of these can involve the question of employee integrity. Mysterious disappearances, misapplication of funds, embezzlement: the descriptions may be different but stealing from your employer in any form is theft. The topic is a difficult one as it can involve your co-workers and friends. However, so are the consequences as they can be significant and lead to the failure of the victim bank.

1. Why Do Some Employees Steal From Their Employers ?

Any of a variety of circumstances can enter into and impact a person's life to a serious enough of a degree where the person's long standing attitudes and values may be changed, and in turn, their behavior may also change. Some motivational factors can include excessive gambling, high personal debts, financial losses, living far beyond one's means, extramarital involvement and related blackmail, excessive use of alcohol, the use of controlled substances, resentment of management, frustration with the job, down sizing and the threat of job loss, greed, and peer-group pressures.

a. Opportunity

Opportunity simply means the measure on the part of the person of the ease and certainty with which a crime can be committed: from stop signs, to theft, to murder. With motivation present, in combination with perceived or actual weaknesses in bank operations: if the employee commits the theft, what is their probability for success ? It is important to note that the potential thief will ask themselves this question prior to the act. Unless discovery and punishment are certain, some employees may take the chance. Another variable in this evaluation process is the diminishing role of law enforcement in financial bank crimes investigations. These agencies are finding their resources seriously limited and will only respond to financial loss incidents of a significant nature. The prospective thief knows this. The bank must project a strong posture in this area to prevent losses from occurring in the first place. Once a loss has occurred the problem can become much more complicated.

b. Employee Attitudes

Employees define what is right and wrong regarding their behavior, and they can rationalize stealing from their employer in their own minds. Thieves normally view themselves as average people in a dishonest world where everyone is just trying to get ahead or to maintain what they have. However, stealing from an employer is no accident. Rather, it occurs only following a careful evaluation process on the part of the employee. This is the key to prevention. As this process takes place prior to the actual incident, what management does or does not do, will effect the employee, their attitude toward the possibility of stealing from the bank, and in fact, whether or not they choose to commit the act.

c. Management Attitude

Where the topic of employee theft is concerned, management's role in defining the norm is especially important. Is senior management assertive in this area, or lax and indecisive ? Management sets the tone and draws the line. The question of integrity starts at the top. If management does not care, there will be more theft. If management does care, there will be fewer instances, and those which do occur will be more effectively resolved.

d. Prevention and Control Measures

The question of employee integrity is not that difficult. Very simply, the act of theft is merely based upon a state of mind, nothing more. In turn, prevention is a state of awareness and caring on the part of management. Only an employee's attitude toward the prospect of stealing from the bank will decide if a loss occurs. Management can impact the attitude and resulting behavior of each individual employee through their efforts prior to an actual loss situation.

The question of any organization's level of integrity begins at the top and can be assured through an effective systems approach which involves a variety of interacting countermeasures. No one effort can prevent employee theft. However, from a systems perspective, a number of coordinated efforts can prevent theft to a high degree. They can also assure quick discovery and the efficient resolution of those situation which do occur.

II. Internal Investigative Risks

1. The Need For Internal Investigations

Of all the situations that can confront the bank security officer, the most sensitive is that which involves the need to review the circumstances surrounding the possibility of an ethical impropriety by a bank employee. Given that the banking industry is based upon a premise of public trust, this situation becomes increasingly more delicate when the matter concerns the prospect of a theft of bank assets on the part of an employee.

When confronted by such a circumstance, the bank security officer is often charged with the responsibility to determine the facts upon which subsequent actions can be based. Such a review process is considered an investigation. An investigation can be defined as a planned and organized determination of facts concerning particular events, occurrences, or conditions relating to a matter of inquiry, the normal nature of which requires three fundamental qualities: objectivity, accuracy, and thoroughness. It is the role of the investigator to satisfy these criteria in each investigation undertaken.

This process, and the assurance of these objectives entails a significant level of responsibility on the part of the reviewer as the questions can be uncomfortable, the findings sometimes startling, and the consequences for error and loss of confidence can be significant.

Traditionally, the security officer has been able to take relevant and preliminary information regarding such incidents to an appropriate law enforcement agency for investigation. However, law enforcement resources that may have been available in the past may no longer be there unless the loss is significant or the circumstances are attractive and warrant valuable investigative resources. Such a circumstance might include the aspect of involvement or conspiracy of an organized crime group, or a foreign based fraud network in the situation. Unless the matter has an interesting twist, the authorities may show little interest and the security officer will be left to conduct the inquiry.

2. Objectives of an Internal Investigation

The security officer should always begin an investigation with the thoughts in mind that nearly all people, including your employees, are honest and would not steal from their employer, that nearly all loss situations turn-out to be "lost assets" as opposed to stolen assets, and that any conclusions that are drawn and presented to management must be based upon and supported by either strong circumstantial or direct evidence. Some general investigative objectives are:

a. The Problem

Circumstances indicate that there may be a loss of assets. The loss may be mysterious, accidental, inadvertent, or an intentional theft. As it appears to be internal in nature, it involves the aspect of a serious violation of trust and ethics. Senior management wants answers, and they want them quickly. As a result, the investigation of such circumstances will often occur under conditions of high stress and emotion between the investigator, and those who are either directly or circumstantially responsible for the missing asset.

In addition, the security officer may not be able to merely refer the matter to the law enforcement sector where professional investigators may be found. The security officer also may or may not be in a position to refer the matter to a professional corporate Security Department, or to engage a private investigator or investigative firm. In many banks, the security officer may simply be left in the position of having to conduct the investigation.

However, merely assigning this sensitive responsibility to the security officer does not mean that he or she has the authority, skills or abilities that are required to successfully meet the stated objectives. Unless the security officer is experienced or has been adequately prepared for the role of an investigator, significant problems can result. In fact, the problems and losses that the bank can suffer due to an improperly conducted investigation can far exceed the situation that began the investigative process. In the heat of the moment, the organization does not want to press so hard for information that errors are made and further damage is done.

3. Investigative Pitfalls

Investigations conducted by a person who is not sure of what he is doing may expose the bank to a variety of civil claims, tort actions, and possibly even criminal charges against an offending bank employee. Given the sensitivity of this process, there are only two options to choose from: invest the resources to do it right and to assure a professional investigative approach, or do not attempt the investigation at all as the consequences for error can be significant. Some related pitfalls can be:

a. Defamation.

Defamation and slander charges can result from publicly uttered statements that injure the reputation of a person, in this case most likely a bank employee. Very simply, do not make statements that can be heard in a public context and be certain that your statements are true although truth is not a defense for defamation. For this reason, all investigative information and discussion, much of which is conjecture, must be considered and treated as strictly confidential. Limit both your written and spoken communications within a management context and on a strict need-to-know basis. Do not conduct interviews in public or open employee areas, and do not discuss investigative findings among the general employee population.

b. Assault.

Assault charges can result should an interviewer intentionally cause fear, harm, coercion or duress. Do not threaten or physically touch the employee in any way. The investigator should not be wearing or expose a firearm or handcuffs during the interview session. Do not push the employee into a chair or place your hand on their shoulder. Do not threaten or coerce them with termination of employment or other adverse action if they do not cooperate.

c. False Imprisonment.

False imprisonment or unlawful restraint charges can result if the interviewer intentionally confines or restricts the movement or freedom of a person. Always make it clear that the employee is free to leave at any time and for any reason although their cooperation is expected given their status as an employee. If they want to visit a rest room, let them. If they do not wish to discuss the situation further without first consulting with their spouse or attorney, allow them to leave. Keep the length of the interview session within reason. Do not keep them past their normal quitting time. Allow them break and lunch periods. Do not place a guard at the door of the interview room.

d. Invasion of Privacy.

Invasion of privacy involves the intrusion on another's privacy. Employees have a reasonable expectation of privacy in their workplace. Be very careful about eavesdropping which can be considered the act of listening secretly to what is being said in private. Do not listen over office partitions or through open office doors as employees discuss personal matters among themselves or over the telephone. Do not listen in on private conversations in the lunch area, lounge or restroom. And although the equipment is readily available, be especially aware that the use of electronic surveillance tactics are strictly forbidden without a court order under the Omnibus Crime Control Act, (18 U.S. Code, Section 2512) and that visual surveillance activities may under certain circumstances be prohibited by the National Labor Relations Act.

e. Searches.

Searches by the bank can generally be conducted in public areas such as a rest room, garage or lounge at any time. However, be careful of searching an area in which the employee may have a reasonable expectation of privacy, such as their desk, locker, purse or vehicle. Also, the bank cannot authorize the police to search areas unless the search is incidental to a lawful arrest, or if they present a warrant issued by a court. While a search may be conducted by the bank for internal purposes such as a question of continued employment, if the objective is clearly to acquire evidence upon which to base a criminal prosecution, it is best to involve the police and to let them seek a warrant.

f. Malicious Prosecution.

Malicious prosecution is the groundless initiating of criminal proceedings against an individual. Be very sure of your controls, documentation and facts, and never stack the deck or misrepresent a case or set of circumstances to the authorities, who in turn may act upon that information, arrest and refer for prosecution the employee in question. There is no room in the investigative process for even one small untruth.

Conducting a successful investigation without any negative repercussions requires coordination, the sharing of responsibilities, and a professional approach. A group comprised of representatives from senior management, legal, auditing, human resources, security and on a need-be basis the criminal justice system, should manage the investigative process to avoid the pitfalls that can trap the solo or less than competent approach. Always remember that this is a review process, not an interrogation, and that the person you are interviewing is an employee who is to be considered innocent unless proven guilty. Anything less can invite serious trouble.

III. Investigation of Internal Loss Situations

Internal loss situations can be prevented to a high degree. However, periodically a condition will arise where a mysterious loss has in fact occurred. Quite often, there may be strong circumstantial evidence to establish that the loss may indeed involve an internal theft of assets by an employee.

Prior to actually being confronted by such an incident, the bank should establish in-house investigative capability to assure that the specialized expertise, required to accurately address and resolve these sensitive situations, is available on short notice. It is a prudent business decision to prepare for such an eventuality, and such an investigative function will demonstrate benefits of deterrence, efficiency, professionalism, a positive criminal justice liaison, successful prosecution of offenders, and the recovery of lost assets. Associated and potential litigation can also be avoided by a professional approach. With this function in place and as warranted, other internal problems such as significant violations of policy and procedure can be investigated, as well as those which involve external criminal activity, such as check fraud.

There are several options available with which to establish the investigative function. They are:

1. Loss Reporting Process

The bank should develop in a policy format, written administrative directives which advise all employees to be aware of their responsibility to report all known or suspected loss situations to their managers. Managers in turn, and within a scope of predetermined protocol, should then be required to report all situations which fulfill the classification as mysterious or confirmed losses to a central authority for independent evaluation, and action as warranted.

Neither employees nor managers should have the responsibility, authority or discretion to resolve loss situations on their own. And this especially as it regards losses within their scope of responsibility. Such documentation can be included in an Ethics Policy, Code of Conduct, or Loss Reporting Policy.

Any such policy should be coordinated between the auditing, accounting, legal, compliance and security departments to assure that each department's objectives are accurately fulfilled and efficiency assured. The initial reporting process should be time sensitive and accomplished without any delay. The process must be assigned a high priority. Any unwarranted delay can increase the likelihood that important evidence or information may be lost, or that the circumstances may continue and result in additional losses. At this early stage of discovery, time is extremely important. The probability for a successful investigative conclusion decreases in direct proportion to the time that is spent in getting the process started.

2. Need for Coordination

If the circumstances appear to warrant an official review, the central authority who evaluates these situations on an ongoing basis should have a designated management group to summon at his or her discretion. This small decision group should include managers of authority from various internal areas including the human resources, auditing, accounting, legal, and security departments, in addition to a representative from senior management. When called together, the group should review the information that is known at the time and establish a course of action to follow. They should determine whether the process is to remain a review, or shift into an actual investigation. They must also decide if the law enforcement authorities are to be contacted and briefed at that time, or later.

3. Verify the Loss

The formal review process must begin by first establishing that a loss has in fact occurred. The asset in question must be accountable at a given point, and conclusively missing at a second given point. With adequate controls and responsibilities assigned, the resulting time frame during which the loss could have taken place should be relatively short. In turn, the number of employees who could be responsible should be few.

If the missing asset cannot be firmly accounted for and controls are weak, the investigation will probably not be conclusive. If this is the result, the self-protection program should be reviewed and reinforced because if the theft was successful, there is a high probability that subsequent losses will occur. It is also as probable that if the asset area in which the initial loss is strengthened, that subsequent losses may occur in other asset areas.

Following an initial unresolved loss situation, it is very important to review and reinforce all control and accountability policies and procedures. In turn, it is then as important to progressively punish employees who elect to violate these administrative controls. As there may be subsequent losses, the objective becomes to increasingly assign controls and accountability with the goal of prevention, and successfully resolving the pattern of loss situations. This action is important as some theft situations and the subsequent series of investigations can take literally months or years to successfully complete.

4. Investigative Process

Establish as many facts as possible from the person reporting the incident, from other relevant employees, and by reviewing documents. Carefully note each individual and their relationship to the operation, and to one another. Organize and closely examine related documents and data. Seek out altered or counterfeit documents, information or data. Watch for unusual circumstances or conditions.

A good investigative rule is, to never stop looking initially just because you identify an obvious answer or solution to the problem. Be aware of the intelligence of the persons who may be involved and be perceptive that the answers could have been planted, or that the situation could involve collusion between several employees in one or more work areas. In your review, be fair, professional and totally objective and do not read anything into the situation. The investigative challenge is to find the facts upon which to base your conclusions.

The investigative group should ask: What does this item mean in relation to something else? What happened before and after? Which individuals are involved, what is known about them and their relationships to one another? Often getting the true answer requires asking just one more question, or turning over just one more piece of paper.

Identify patterns between people and processes. Turn your investigative information into a flow chart or diagram on a chalkboard. Quite often when intangible data is configured into a picture, the answer often becomes apparent. Strive to identify which employees consistently appear along this analysis process. Then strive to identify both their professional and personal relationships to one-another in combination with the knowledge and abilities they have.

The bank may find that by taking the initiative and conducting part of the investigation, the law enforcement authorities may then offer support and assistance. As the bank builds a reputation for efficiency in this area, trust will be established with the authorities. In turn, law enforcement investigators will become more receptive to being involved when it is shown that they will not have to bear the entire investigative effort themselves.

5. Interviewing

During the initial review process, and as the investigation begins to take form, it will be necessary to interview employees. Then as the investigation develops a direction of logic to pursue, it will be necessary to re-interview select employees.

Interviewing in the context of an internal review being conducted with bank employees in the investigative role means the general review of the facts and circumstances surrounding an incident. Interrogation is the structured, and aggressive questioning of possible criminal suspects. As bank employees, you are not the police and you have neither their authority nor objectives to attain. As a private individual, a bank investigator's authority and mission is substantially limited in comparison to the public law enforcement authorities. The bank investigator's job is to interview his or her fellow employees with the objectives of developing information, supporting prosecution and recovering lost assets. It is appropriate to maintain a conservative posture and to leave hard line interrogations to the police.

Always remember that the individuals to whom you will be speaking are your fellow employees. They are to be presumed innocent unless evidence or their admissions prove them guilty. In reality the great majority of losses are just that, losses due to an error or lack of competency, and not theft. Generally it is more productive in both the short and long terms to approach these interview sessions in a positive manner.

Prior to speaking with the employee, have your facts straight and be sure of their source and accuracy. Take time to develop your base of conversation prior to beginning the interview sessions. It is best to place yourself into a position of strength prior to the interview session and you must allow yourself enough time to attain that position. If you do not, the employee may be able to take control of the conversation and leave you in an embarrassing position.

Interviewing should be a team effort. Comprise the interview team of two persons who meet the interview session objectives and make up of the person who is to be interviewed. Two interviewers are appropriate to fulfill witness and listening needs, more than two is intimidating, and one can lead to problems such as sexual harassment claims.

The session should be scheduled for a time that is convenient for the employee. Schedule the session through their supervisor to respect the chain of command and operational needs although this person does not need to know the particulars of the session. It is merely a confidential matter that needs to be discussed. The session should be held in a private place and away from interruptions. It is also best if the interview room is void of distractions such as windows, wall hangings, and telephones.

Briefly introduce yourself and set the employee at ease with a smile and handshake. Present the employee with a brief synopsis of the facts, referring to known evidence and circumstances. State the implications in soft, passive terms. A conservative process will result in more efficient and productive results than does the tough guy approach to problems. Do not accuse the person of stealing the missing asset. However, it is appropriate to ask them what they do know about the situation, if they did take the asset, of if they know or think they know where it went. Many mysterious disappearances have been completely solved by merely asking this question. Likewise, much time and energy have been invested by investigators who failed to ask that simple question. Sometimes when asked, the person may respond by admitting to the theft. They may also state that they had merely been waiting for someone to ask the question, and that they are glad to get it over with, because they knew they were going to be caught anyway. If you don't ask the question, you won't get the answer. Ask the question early on during the interview.

While the interview is being conducted, only one person should speak at a time. The other should listen, watch, witness and take notes. Then reverse the roles. Closely observe the person's verbal and nonverbal behavior and responses. Very often the unspoken word will convey information which is significantly more important than what the person actually says. Encourage the employee to respond and provide their thoughts and version of the situation. The interviewers should interrupt only to clarify points and should refrain from pointed questions until after the person has finished talking.

In knowing that the interview session is being held in confidence, employees will also openly discuss other operational and personnel problems in their work areas. An astute interview team can glean much valuable information regarding just how circumstance in the workplace that warrant improvement can be enhanced. Take the opportunity to build confidence with the employee, and to learn from them. Your employees have a wealth of experience and knowledge, and very good ideas. However, only too often we do not take the time to ask the question, and then to listen to the answer.

If there is reason to believe that the employee may be withholding information, or is being less than truthful in their responses, sit close to the person and as the questioning progresses, move in closer and maintain eye contact. Use compassion and show concern for the employee's problems. The majority of the time you will be more successful if you establish a role of a mediator instead of an adversary. Or, if your interview team is experienced and works well together, the old "Mutt and Jeff" routine of friend and foe can be applied. Press on with your line of questioning.

If the employee indicates that he or she prefers not to cooperate, do not intimidate nor threaten the person. In such a situation the interview should be concluded and the person escorted to the Human Resources Department. Do not allow the person to return to the work area as you may lose valuable evidence that you are not yet aware of. At the discretion of legal and personnel representatives, the employee may be subject to immediate suspension for refusal to cooperate in an official inquiry. Document the situation as appropriate, refer the matter to the law enforcement authorities who may wish to interview the person later.

6. Maintain Control

Your interview questions should concentrate upon and seek out specific items of information to clearly establish the facts of the situation, and to counter denials. Maintain control of the session and watch carefully for the employee's attempts to sidetrack or lead you away from the topic, or to blame others for the loss. Go back through the stories and give the employee the opportunity to either contradict himself, or repeatedly offer the same story as if rehearsed.

If the person is being less than truthful, your ability to identify inconsistencies in the employee's statements will require them to generate more lies, and in time the story will begin to come apart. Simply stated, once a person begins lying, they must then continue lying to cover their tracks. With time, it becomes difficult to keep the truths and untruths in order. This is exactly why there should be two interviewers: one each to question and listen.

Regarding body language, which can be either verbal or physical, be aware that the innocent person may sit upright in their chair, listen to your every word, maintain strong eye contact, lean forward toward you, give quick answers and denials without the benefit of having to think about the answer, and may well become angry, hostile, and insulting. On the other hand, the possibly guilty subject may not come back at you in this manner, but rather may pay a game of intellectual cat and mouse.

However, never lose sight of the fact that this is your employee who very well may be nervous, and as a result may be acting in an unusual manner.

If you have reason to suspect the person's story, provide them with alternative reasons for committing the act, and avoid trigger and negative words such as "stealing" or "crime." The use of the wrong words can alienate and put the subject on the defensive, and this may destroy the conversation. Your objective is to establish and then maintain an open line of communication. Work to acquire the subject's confidence and encourage discussion of the circumstances in the employee's own words.

7. Keeping After the Truth

If the first interview sessions are inconclusive but there does seem to be merit in proceeding, the interviewers should organize their thoughts and discuss the results with the investigative group. Again, consider the relationships of individuals and draw the circumstances in a picture form, look for discrepancies, formulate new questions and interview the employees again.

If you are accurate in your method and as you begin to narrow in and get closer to the truth, one of two things may happen. First of all, very seldom is there such a thing as a lone person in a true theft situation. While only one person may be doing the actual stealing, very often one or more additional employees are aware of the activity. This probability increases the longer the theft activity has been taking place. This is where an ethics policy which holds all employees equally responsible for any improper activity in the workplace is especially important.

Very few people will risk losing their jobs to protect a fellow worker who they know has been stealing. They will keep quiet to a point, but if they believe that the thief is going to be discovered, with the consequence that they may also be discovered, they may suddenly take notice of the ethics policy and tell what you need to know to save themselves.

Secondly, and if you are doing your investigative job in an efficient manner, the guilty person may realize that they are trapped and begin to make deals with you. Should this happen, let them talk. You are not the police and whatever they say in the context of a free admission, is admissible against them in court. During the interview sessions, should an admission be gained it should immediately be put in writing and signed by the employee, the investigators, and an independent witness.

Also, at the point of an admission of guilt, immediately push for other information as to what else is going on, and who else is involved. The investigators should never make deals to gain information. While the investigative team can act in the role of mediators in the process, matters to waive prosecution or to accept restitution in lieu of prosecution are properly for review by representatives of senior management, legal, human resources and the prosecutor's office.

During your interviews and as you work around "hot" questions, be very aware of the subject's responses as deceptive individuals may play games with you where a simply yes or no answer would be sufficient.

However, in some cases your investigation will simply reach a dead end. Push the interview to a point of reasonableness but conclude the session if your evidence is weak, and if the employee's responses can be validated. If you do reach a dead end, visit with your law enforcement representatives in strict confidence and share your results to that point. It is very possible that by working as a team with them, your investigative group can follow the direction and suggestions provided by the authorities and pursue new options. If the case can be developed enough by the bank, it is then possible for the authorities to gain for instance a search warrant, or subject select of your employees to a polygraph examination. A positive liaison with the authorities can be the key to a successful investigative effort.

8. Legal Aspects

In court, investigative actions will be judged in view of all the circumstances and facts in order to determine whether or not a confession or statement was voluntary and therefore truthful.

As bank investigators, the team is freed from the responsibilities of the Miranda Decision, and statements that are made are admissible. Likewise, only law enforcement personnel can entrap a person. A private investigative team has the privilege of inserting controlled items, such as currency, into a suspected employee's work to measure integrity. As long as the items are strictly controlled and accounted for there is nothing wrong with allowing the employee an opportunity to make an independent decision. But, do not solicit or direct another person to commit a dishonest act as a part of the investigative process.

Investigative matters that involve outside criminal events such as fraud, robbery and larceny warrant accuracy. However, investigations that focus upon the integrity and ethics of your own staff can be extremely sensitive, emotional and dangerous. If approached and conducted in error, they can carry the consequences of failure, severely damaged employee relations and morale, the loss of confidence by the criminal justice system, and litigation.

There are only two options when it comes to conducting your own internal investigations: either invest the resources to assure a professional approach and do it right, or, do not attempt it at all.

 


 

John W. Kennish, CPP - Security Consultant
62 East Pond Meadow Road, Westbrook, Connecticut 06498
(860) 399-8545
Kennish.com
E-Mail John Kennish
© 2006 John W. Kennish, CPP

Top of Page

John Kennish Home Page


You are visitor to this site.
LE FastCounter