Fraud Investigation Report Template (Evidence, Chain of Custody, Loss)

Fraud Investigation Report: [Case reference]

Report of one fraud investigation, from the allegation and the decision to investigate, through the investigation plan, evidence handling and chain of custody, interviews and analysis, to findings, loss quantification, root cause, remediation and reporting to management, regulators and law enforcement. The structure is original and reflects common investigation practice as described by professional bodies such as the Association of Certified Fraud Examiners (ACFE, named only), the GAO Fraud Risk Framework (GAO-15-593SP, US public domain), the EU Whistleblower Directive (Directive (EU) 2019/1937) for reports received through the speak-up channel, and the UK failure to prevent fraud offence (Economic Crime and Corporate Transparency Act 2023, section 199, in force since 2025-09-01). The example bank, Fernhollow Bank, its staff and customers are fictional. Replace every [bracketed] value and every row marked Example. Obtain the law and guidance for the normative text. This is a document format, not legal, accounting or employment law advice.

Document control

Approvals

Revision history

Contents

• 1. Executive summary
• 2. Allegation and predication
• 3. Mandate, scope and team
• 4. Investigation plan
• 5. Legal and regulatory considerations
• 6. Evidence handling and chain of custody
• 7. Interviews
• 8. Analysis and findings
• 9. Loss quantification
• 10. Control failures and root cause
• 11. Remediation and recommendations
• 12. Reporting, referrals and disclosures
• 13. Glossary and references
• Standard and licence note

1. Executive summary

Write this section last, after legal review. Use neutral language, refer to people by role or pseudonym, and give the evidence strength for each key finding (established, probable, not established). State clearly what the investigation could not determine.

Example summary (fictional): On 2026-05-11 the whistleblowing channel received an anonymous report that a payments operations officer (E1) was moving money out of dormant customer accounts. The investigation established that between 2025-10-06 and 2026-04-28, E1's user ID executed 14 manual internal transfers totalling EUR 179,500 from nine dormant accounts to three accounts held by a customer (A1) who shares an address with E1. No customer authorisation or business reason exists for any of the transfers. Every transfer was below the EUR 15,000 threshold above which a second approver is required, and the dormant-account reactivation report was not reviewed in the period. Net loss to the bank after recoveries is estimated at EUR 63,500, including investigation costs; this assumes an insurance recovery of EUR 113,200 that the insurer has not yet accepted. Affected customers have been made whole. The matter was reported to the financial intelligence unit and referred to the police; E1's employment was terminated after a disciplinary process.

2. Allegation and predication

Summarise the allegation exactly as received, without improving it, and the preliminary checks performed before deciding to investigate. Record the decision and who made it. If the report came through the whistleblowing channel, apply the confidentiality and anti-retaliation rules of the Whistleblowing Policy (compliance/whistleblowing-policy): under Directive (EU) 2019/1937 the identity of the reporting person is protected (Article 16) and retaliation is prohibited (Article 19), as transposed in national law. Acknowledge receipt and give feedback within the deadlines your policy and national law set (Article 9 sets at most 7 days for acknowledgement and a reasonable timeframe of no more than 3 months for feedback).

3. Mandate, scope and team

The mandate states the questions, the period, the entities and the systems in scope, the authority of the investigators to access data and interview staff, and the reporting line. Keep the investigation team independent of the area under review. Every member signs a conflict of interest and confidentiality declaration. If external forensic specialists are engaged, engage them through legal counsel when privilege is sought, and record the engagement terms.

4. Investigation plan

Work from the outside in: preserve and collect data and documents first, analyse them, interview witnesses, and interview the subject last, when you can put the evidence to them. Write hypotheses that the evidence can confirm or refute, including innocent explanations. Update the plan as facts emerge and record changes with the date and reason.

5. Legal and regulatory considerations

Record each legal check and who confirmed it. Typical considerations include data protection (in the EU, a lawful basis under GDPR Article 6 and the rules on data relating to criminal offences in Article 10, plus a data protection impact assessment where monitoring is intrusive; see DPIA, compliance/dpia), employment law and works council agreements, the rights of the subject (right to be heard, representation at interviews where the law or contract provides it), whistleblower protection, legal privilege, cross-border data transfers, and mandatory reporting duties. A bank that knows or suspects that funds are the proceeds of crime must report to its financial intelligence unit under anti-money laundering law, and must not tip off the subject; see SAR/STR Narrative (compliance/sar-str-narrative). Supervisors may also expect notification of significant internal fraud. In the United Kingdom, consider the failure to prevent fraud offence for frauds committed by associated persons for the organisation's benefit; in this example the fraud was against the bank, so the offence is not engaged, but record the analysis.

6. Evidence handling and chain of custody

Preserve before you analyse. Issue a legal hold to suspend deletion of relevant data, image devices forensically, export system logs with a hash value, and store originals in a restricted location. Each exhibit gets an ID, a description, the collector, the date and time, the method, the hash where digital, the storage location and every transfer of custody. Analyse working copies, never originals. For digital evidence, follow a recognised method (for example the approach of ISO/IEC 27037, named only) and the instructions of the forensic specialist.

7. Interviews

Plan each interview: purpose, topics, documents to show, interviewer and note taker, and the rights to be explained (voluntary nature for witnesses, representation where applicable, confidentiality). Interview witnesses before the subject. Use open questions first, then specific questions, then put the evidence. Record the interview with consent or take verbatim notes, and offer the interviewee the chance to review and sign. Record refusals and the reason given. Never promise outcomes or make threats, and stop and seek legal advice if an interview reveals a possible criminal offence by someone not yet considered.

After each interview, the note taker completes the record the same day, the interviewer checks it, and both sign it. Store recordings and transcripts as exhibits under section 6. Where the interview is held in another language, use an independent interpreter and record the interpreter's name. Keep a separate log of contacts with the subject's representative and of any documents the subject provides, because these often become evidence in later proceedings.

Summary of the subject interview (Example): E1 confirmed knowing A1 as a relative living at the same address. E1 initially said the transfers corrected booking errors, then, when shown that the source accounts had no booking errors and that no customer instruction existed, declined to comment further. E1 did not suggest that anyone else used the user ID.

8. Analysis and findings

Present findings in the order of the mandate questions. For each, give the fact pattern, the exhibits relied on, the alternative explanations considered and why they were rejected, and the evidence strength. Use a consistent scale: established (supported by reliable evidence with no credible alternative), probable (more likely than not), not established.

Report writing standards for this section:

• Write in the past tense and in the order the events happened. Give dates, amounts, account and exhibit references for every statement of fact, so a reader can trace it to the evidence.
• Keep opinions out of the findings. Where the investigator draws an inference (for example about who sat at a workstation), say that it is an inference and what it rests on.
• Report exculpatory evidence as fully as incriminating evidence. A report that omits facts favourable to the subject loses credibility with disciplinary panels, courts and regulators.
• Use pseudonyms (E1, A1) in the body and keep the key to names in a restricted annex, so the report can be shared more widely if needed.
• Describe what the investigation could not do (data that no longer existed, people who declined interview) and how that limits the findings.

Transfer summary:

9. Loss quantification

Quantify the gross loss (funds taken), customer remediation, direct investigation and remediation costs, and recoveries, each with its basis and status. Treat expected insurance recoveries as contingent until the insurer accepts the claim; accounting recognition of a reimbursement follows the applicable standard (for IFRS reporters IAS 37, named only) and must be agreed with finance. Record the event in the operational loss database using the Operational Loss Event Report (finance/operational-loss-event-report).

All amounts in EUR, as of 2026-07-24.

If the insurance claim fails, the net loss rises to EUR 176,700 (218,000 - 41,300). Show both figures to the sponsor so the decision on further civil recovery against E1 and A1 is informed.

10. Control failures and root cause

For each control that failed or was missing, describe the design gap or operating failure and the underlying cause. Link each to the risk and control in the Fraud Risk Assessment (compliance/fraud-risk-assessment) and, where relevant, to the Risk and Control Matrix (compliance/risk-control-matrix) and the operational risk RCSA (finance/operational-risk-rcsa). Consider incentives and pressure, opportunity and rationalisation, but keep the analysis to observable facts.

11. Remediation and recommendations

Internal audit validates closure of High actions and reports to the audit committee; see Internal Audit Engagement (compliance/iia-internal-audit-engagement).

12. Reporting, referrals and disclosures

Internal reporting goes to the sponsor, and a summary goes to the audit committee. External reporting depends on the facts and the jurisdiction: financial intelligence unit, police or prosecutor, supervisor, insurer, data protection authority where personal data was compromised, and affected customers. Give feedback to the whistleblower within the statutory period without disclosing personal data of others. Keep all communication factual and consistent with the report. Keep this log open after the final report is issued and add later entries (audit committee, supervisor updates, whistleblower feedback) as they occur.

13. Glossary and references

Glossary:

• Predication: circumstances that justify starting an investigation.
• Chain of custody: the documented history of who held an item of evidence, when and why, from collection to presentation.
• Legal hold: an instruction to suspend deletion of data that may be relevant to an investigation or litigation.
• Exhibit: an item of evidence with a unique ID.
• Subject: a person whose conduct is under investigation.
• Gross loss / net loss: loss before and after recoveries.
• Legal privilege: protection of certain lawyer communications from disclosure, with conditions that vary by country.

References (as of 2026-10; check the current official versions):

• GAO, A Framework for Managing Fraud Risks in Federal Programs, GAO-15-593SP (2015), US public domain.
• Directive (EU) 2019/1937 on the protection of persons who report breaches of Union law, Articles 9, 16 and 19, as transposed.
• Regulation (EU) 2016/679 (GDPR), Articles 6 and 10.
• UK Economic Crime and Corporate Transparency Act 2023, section 199 (failure to prevent fraud), in force 2025-09-01, and Home Office guidance.
• Association of Certified Fraud Examiners (ACFE), professional standards and Fraud Examiners Manual, named only; COSO and ACFE Fraud Risk Management Guide, second edition (2023), named only.
• ISO/IEC 27037 (digital evidence identification, collection, acquisition and preservation), named only.
• Related templates: Fraud Risk Assessment (compliance/fraud-risk-assessment), Whistleblowing Policy (compliance/whistleblowing-policy), SAR/STR Narrative (compliance/sar-str-narrative), Operational Loss Event Report (finance/operational-loss-event-report), Incident Response Plan (compliance/incident-response-plan), Design Fraud Detection (system-design/design-fraud-detection).

Standard and licence note

Structure aligned with common fraud examination practice; the ACFE, COSO and ISO/IEC 27037 materials are protected by copyright and are cited by name only, with no text reproduced or paraphrased. Legal references are based on the GAO Fraud Risk Framework (US public domain), EU law (Directive (EU) 2019/1937, Regulation (EU) 2016/679, EUR-Lex) and UK legislation, described in original wording. The template text, scales and the Fernhollow Bank case are original and fictional; no real person or company is described. Check the current official texts and national law, especially employment and data protection law, before use. This is a document format, not legal, accounting or employment law advice. Template licence: MIT.