# Fraud Investigation Report: [Case reference]

> Report of one fraud investigation, from the allegation and the decision
> to investigate, through the investigation plan, evidence handling and
> chain of custody, interviews and analysis, to findings, loss
> quantification, root cause, remediation and reporting to management,
> regulators and law enforcement. The structure is original and reflects
> common investigation practice as described by professional bodies such
> as the Association of Certified Fraud Examiners (ACFE, named only), the
> GAO Fraud Risk Framework (GAO-15-593SP, US public domain), the EU
> Whistleblower Directive (Directive (EU) 2019/1937) for reports received
> through the speak-up channel, and the UK failure to prevent fraud
> offence (Economic Crime and Corporate Transparency Act 2023, section
> 199, in force since 2025-09-01). The example bank, Fernhollow Bank, its
> staff and customers are fictional. Replace every `[bracketed]` value
> and every row marked *Example*. Obtain the law and guidance for the
> normative text. This is a document format, not legal, accounting or
> employment law advice.

<!--
Guidance: How to use this template
- One file per investigation. Sections 1 to 6 are written at the start
  (allegation, mandate, plan, legal checks, evidence rules) and approved
  by the investigation sponsor. Sections 7 to 12 are completed as the work
  progresses. Section 1 is finalised last.
- Write facts, not conclusions about guilt. The report establishes what
  happened, how, who was involved, the loss and the control failures.
  Disciplinary, civil and criminal outcomes are decided by others.
- Consider legal privilege before you start: in many jurisdictions an
  investigation directed by counsel and marked accordingly gets better
  protection. Agree the reporting line with legal at the outset.
- For the fraud risk assessment of the whole organisation, use Fraud Risk
  Assessment (`compliance/fraud-risk-assessment`); for the design of
  automated fraud detection, use Design Fraud Detection
  (`system-design/design-fraud-detection`).
- Common pitfall: collecting evidence informally (screenshots, forwarded
  emails) before the scope is approved, which damages its integrity and
  can breach data protection or employment law.
-->

## Document control

<!-- Guidance: Access should be limited to the investigation team, the sponsor and legal. Classification and retention follow your investigations policy and any legal hold. -->

| Field | Value |
|---|---|
| Document ID | [FI-2026-009] *(Example)* |
| Case title | [Unauthorised transfers from dormant accounts] *(Example)* |
| Organisation | [Fernhollow Bank] *(Example, fictional EU credit institution)* |
| Allegation source | [Whistleblowing channel, report WB-2026-031] *(Example)* |
| Investigation sponsor | [@chief-risk-officer] |
| Lead investigator | [@lead-investigator] |
| Legal counsel | [@legal-counsel] |
| Version | [1.0] |
| Status | [Assessment / Investigation / Draft report / Final / Closed] |
| Owner | [@lead-investigator] |
| Approvers/reviewers | [@sponsor], [@legal-counsel], [@chief-audit-executive] |
| Last updated | YYYY-MM-DD |
| Classification | [Strictly confidential; legally privileged where applicable] |
| Legal hold | [LH-2026-012 issued 2026-05-13] *(Example)* |
| Retention | [Per investigations policy and limitation periods; minimum 10 years] *(Example)* |

### Approvals

| Stage | Role | Name | Decision | Date |
|---|---|---|---|---|
| Decision to investigate and mandate | Investigation sponsor | [@name] | [Approved] | YYYY-MM-DD |
| Investigation plan | Sponsor and legal counsel | [@name] | [Approved] | YYYY-MM-DD |
| Interviews of subjects | Legal counsel and HR | [@name] | [Approved] | YYYY-MM-DD |
| Final report | Sponsor | [@name] | [Accepted] | YYYY-MM-DD |
| External reporting | MLRO, legal, compliance | [@name] | [Agreed] | YYYY-MM-DD |

### Revision history

| Version | Date | Author | Change |
|---|---|---|---|
| 0.1 | YYYY-MM-DD | [@lead-investigator] | Allegation assessment and mandate |
| 0.5 | YYYY-MM-DD | [@lead-investigator] | Investigation plan approved |
| 1.0 | YYYY-MM-DD | [@lead-investigator] | Final report |

## Contents

- [1. Executive summary](#1-executive-summary)
- [2. Allegation and predication](#2-allegation-and-predication)
- [3. Mandate, scope and team](#3-mandate-scope-and-team)
- [4. Investigation plan](#4-investigation-plan)
- [5. Legal and regulatory considerations](#5-legal-and-regulatory-considerations)
- [6. Evidence handling and chain of custody](#6-evidence-handling-and-chain-of-custody)
- [7. Interviews](#7-interviews)
- [8. Analysis and findings](#8-analysis-and-findings)
- [9. Loss quantification](#9-loss-quantification)
- [10. Control failures and root cause](#10-control-failures-and-root-cause)
- [11. Remediation and recommendations](#11-remediation-and-recommendations)
- [12. Reporting, referrals and disclosures](#12-reporting-referrals-and-disclosures)
- [13. Glossary and references](#13-glossary-and-references)
- [Standard and licence note](#standard-and-licence-note)

## 1. Executive summary

<!-- Guidance: Purpose: tell the sponsor in one page what was alleged, what was found, how much was lost, which controls failed and what must happen next. Pitfall: stating that a named person "committed fraud". Describe the conduct and the evidence; leave legal characterisation to counsel and the authorities. -->

Write this section last, after legal review. Use neutral language,
refer to people by role or pseudonym, and give the evidence strength for
each key finding (established, probable, not established). State
clearly what the investigation could not determine.

*Example summary (fictional):* On 2026-05-11 the whistleblowing channel
received an anonymous report that a payments operations officer (E1) was
moving money out of dormant customer accounts. The investigation
established that between 2025-10-06 and 2026-04-28, E1's user ID
executed 14 manual internal transfers totalling EUR 179,500 from nine
dormant accounts to three accounts held by a customer (A1) who shares an
address with E1. No customer authorisation or business reason exists for
any of the transfers. Every transfer was below the EUR 15,000 threshold
above which a second approver is required, and the dormant-account
reactivation report was not reviewed in the period. Net loss to the bank
after recoveries is estimated at EUR 63,500, including investigation
costs; this assumes an insurance recovery of EUR 113,200 that the
insurer has not yet accepted. Affected customers have been made whole. The matter
was reported to the financial intelligence unit and referred to the
police; E1's employment was terminated after a disciplinary process.

| Key finding | Evidence strength |
|---|---|
| F-01 Unauthorised transfers executed under E1's user ID | Established |
| F-02 E1 personally operated the user ID at the time of the transfers | Established for 12 of 14; probable for 2 |
| F-03 Funds benefited A1, connected to E1 | Established |
| F-04 Other employees involved | Not established; no evidence found |

## 2. Allegation and predication

<!-- Guidance: Purpose: record what was alleged and why there was enough basis to investigate. Predication is the set of circumstances that would lead a reasonable professional to believe fraud may have occurred. Pitfall: launching an intrusive investigation on rumour, or dismissing an anonymous report without a preliminary check. -->

Summarise the allegation exactly as received, without improving it, and
the preliminary checks performed before deciding to investigate. Record
the decision and who made it. If the report came through the
whistleblowing channel, apply the confidentiality and anti-retaliation
rules of the Whistleblowing Policy (`compliance/whistleblowing-policy`):
under Directive (EU) 2019/1937 the identity of the reporting person is
protected (Article 16) and retaliation is prohibited (Article 19), as
transposed in national law. Acknowledge receipt and give feedback within
the deadlines your policy and national law set (Article 9 sets at most 7
days for acknowledgement and a reasonable timeframe of no more than 3
months for feedback).

| Field | Value |
|---|---|
| Date received | [2026-05-11] *(Example)* |
| Channel | [Whistleblowing platform, anonymous, two-way messaging] *(Example)* |
| Allegation summary | [Officer in payments operations moves money from dormant accounts to an acquaintance] *(Example)* |
| Preliminary checks | [Query of manual transfers from dormant accounts in last 12 months: 14 transfers by one user ID to three related accounts] *(Example)* |
| Predication conclusion | [Sufficient: specific allegation corroborated by system data] *(Example)* |
| Decision and decision maker | [Investigate; sponsor @chief-risk-officer, 2026-05-12] *(Example)* |
| Immediate containment | [Manual transfer rights of E1 removed 2026-05-13 under a routine access review pretext approved by legal; dormant accounts flagged] *(Example)* |

## 3. Mandate, scope and team

<!-- Guidance: Purpose: define the questions the investigation must answer, the boundaries and the people. Pitfall: scope creep into unrelated matters without approval, or a team member with a conflict of interest. -->

The mandate states the questions, the period, the entities and the
systems in scope, the authority of the investigators to access data and
interview staff, and the reporting line. Keep the investigation team
independent of the area under review. Every member signs a conflict of
interest and confidentiality declaration. If external forensic
specialists are engaged, engage them through legal counsel when privilege
is sought, and record the engagement terms.

| Field | Value |
|---|---|
| Questions to answer | [What transfers were unauthorised? Who executed them? Who benefited? What was the loss? Which controls failed? Are other staff or accounts involved?] *(Example)* |
| Period in scope | [2024-05-01 to 2026-05-13, extended if evidence requires] *(Example)* |
| Systems in scope | [Core banking, payment operations workflow, identity and access logs, email, badge access, CCTV retained] *(Example)* |
| Out of scope | [Customer complaints unrelated to dormant accounts] *(Example)* |
| Reporting line | [Sponsor, through legal counsel] *(Example)* |

| Team member | Role | Independence and conflict declaration |
|---|---|---|
| [@lead-investigator] *(Example)* | Lead, Group Investigations | Signed 2026-05-12, no conflict |
| [@forensic-it] *(Example)* | Digital forensics (external firm via counsel) | Signed, engagement letter EL-2026-07 |
| [@data-analyst] *(Example)* | Transaction analytics, Internal Audit | Signed, no conflict |
| [@hr-partner] *(Example)* | Employment process adviser | Signed; not involved in fact-finding |

## 4. Investigation plan

<!-- Guidance: Purpose: turn the questions into hypotheses, steps and evidence sources, in an order that protects evidence. Pitfall: interviewing the subject before collecting documents and data, which gives the subject time to destroy or align evidence. -->

Work from the outside in: preserve and collect data and documents first,
analyse them, interview witnesses, and interview the subject last, when
you can put the evidence to them. Write hypotheses that the evidence can
confirm or refute, including innocent explanations. Update the plan as
facts emerge and record changes with the date and reason.

| Step ID | Hypothesis or question | Action | Evidence source | Owner | Status |
|---|---|---|---|---|---|
| PLN-01 *(Example)* | Transfers lack customer authorisation | Search for customer instructions, call recordings, correspondence | Document management, telephony | [@lead-investigator] | Done |
| PLN-02 *(Example)* | Transfers made from E1's workstation while E1 present | Correlate transaction times with login, device and badge data | Access logs, badge system | [@forensic-it] | Done |
| PLN-03 *(Example)* | Funds benefited E1 or associates | Trace onward movement from A1's accounts | Core banking, payment messages | [@data-analyst] | Done |
| PLN-04 *(Example)* | Other users made similar transfers | Full-population analytics on manual transfers from dormant accounts, 24 months | Core banking | [@data-analyst] | Done, none found |
| PLN-05 *(Example)* | E1's credentials were used by someone else | Check password resets, concurrent sessions, absence records | Identity system, HR records | [@forensic-it] | Done |
| PLN-06 *(Example)* | Supervisory review should have detected the activity | Review reactivation report distribution and sign-off | Operations records | [@lead-investigator] | Done |
| PLN-07 *(Example)* | Subject's account of events | Interview E1 with evidence | Interview | [@lead-investigator] | Done |

```mermaid
flowchart TD
  A["Allegation received"] --> B["Predication check"]
  B -->|"insufficient"| C["Close with record"]
  B -->|"sufficient"| D["Mandate and legal hold"]
  D --> E["Preserve and collect evidence"]
  E --> F["Analyse data and documents"]
  F --> G["Witness interviews"]
  G --> H["Subject interview"]
  H --> I["Findings and loss"]
  I --> J["Report and referrals"]
  J --> K["Remediation tracking"]
```

## 5. Legal and regulatory considerations

<!-- Guidance: Purpose: confirm before collecting evidence that each step is lawful and that mandatory reports are not missed. Pitfall: monitoring an employee's email or device without a lawful basis or in breach of works council agreements, which can make evidence unusable and expose the organisation to claims. -->

Record each legal check and who confirmed it. Typical considerations
include data protection (in the EU, a lawful basis under GDPR Article 6
and the rules on data relating to criminal offences in Article 10, plus a
data protection impact assessment where monitoring is intrusive; see
DPIA, `compliance/dpia`), employment law and works council agreements,
the rights of the subject (right to be heard, representation at
interviews where the law or contract provides it), whistleblower
protection, legal privilege, cross-border data transfers, and mandatory
reporting duties. A bank that knows or suspects that funds are the
proceeds of crime must report to its financial intelligence unit under
anti-money laundering law, and must not tip off the subject; see SAR/STR
Narrative (`compliance/sar-str-narrative`). Supervisors may also expect
notification of significant internal fraud. In the United Kingdom,
consider the failure to prevent fraud offence for frauds committed by
associated persons for the organisation's benefit; in this example the
fraud was against the bank, so the offence is not engaged, but record the
analysis.

| Consideration | Assessment *(Example)* | Confirmed by | Date |
|---|---|---|---|
| Lawful basis for processing employee data | Legitimate interest and legal obligation; investigation privacy notice applies | [@dpo] | 2026-05-13 |
| Email and device review | Permitted under IT acceptable use policy and works agreement; keyword-limited review | [@legal-counsel] | 2026-05-13 |
| Whistleblower identity | Reporter anonymous; no attempt to identify | [@whistleblowing-officer] | 2026-05-12 |
| Suspicious transaction report | Required; filed 2026-05-21 by MLRO | [@mlro] | 2026-05-21 |
| Supervisor notification | Notified under internal operational incident policy | [@head-compliance] | 2026-06-02 |
| Insurance notification | Crime insurance notified within policy deadline | [@insurance-manager] | 2026-05-20 |
| Privilege | Investigation directed by legal counsel; report marked accordingly | [@legal-counsel] | 2026-05-12 |
| Subject interview after the STR | FIU and law enforcement consulted on timing; interview plan makes no reference to the report, so it cannot tip off or prejudice an investigation | [@mlro] | 2026-06-10 |

## 6. Evidence handling and chain of custody

<!-- Guidance: Purpose: show that every item of evidence is authentic, complete and unaltered from collection to report. Pitfall: copying files from a live system with no hash and no record of who collected them, which lets the defence challenge every exhibit. -->

Preserve before you analyse. Issue a legal hold to suspend deletion of
relevant data, image devices forensically, export system logs with a
hash value, and store originals in a restricted location. Each exhibit
gets an ID, a description, the collector, the date and time, the method,
the hash where digital, the storage location and every transfer of
custody. Analyse working copies, never originals. For digital evidence,
follow a recognised method (for example the approach of ISO/IEC 27037,
named only) and the instructions of the forensic specialist.

| Exhibit ID | Description | Collected by | Date and time | Method | Hash (SHA-256, first 12) | Storage |
|---|---|---|---|---|---|---|
| EX-001 *(Example)* | Core banking export, manual transfers 2024-05 to 2026-05 | [@data-analyst] | 2026-05-13 10:42 | Read-only database extract | [3f9a1c07b2e4] | Evidence vault, folder FI-2026-009 |
| EX-002 *(Example)* | Identity and access logs for E1's user ID | [@forensic-it] | 2026-05-13 14:05 | Log export by IT security | [a81d55e0c9f3] | Evidence vault |
| EX-003 *(Example)* | Forensic image of E1's workstation | [@forensic-it] | 2026-05-20 07:30 | Write-blocked imaging | [7c20be4419da] | External firm vault |
| EX-004 *(Example)* | Badge access records | [@security-manager] | 2026-05-14 09:15 | System report, signed | [e04f6b2a17c8] | Evidence vault |
| EX-005 *(Example)* | Account documentation for A1 | [@lead-investigator] | 2026-05-14 11:00 | Document management export | [5b9e30d8f611] | Evidence vault |
| EX-006 *(Example)* | Interview records (section 7) | [@lead-investigator] | Various | Signed notes and recordings with consent | [per file] | Evidence vault |

| Exhibit ID | From | To | Date | Purpose | Signature |
|---|---|---|---|---|---|
| EX-003 *(Example)* | [@forensic-it] | External firm lab | 2026-05-20 | Analysis | [Signed] |
| EX-003 *(Example)* | External firm lab | Evidence vault | 2026-06-30 | Return after analysis | [Signed] |

## 7. Interviews

<!-- Guidance: Purpose: obtain and record accounts from witnesses and the subject fairly and accurately. Pitfall: leading questions, interviews without a second person present, or notes written days later. -->

Plan each interview: purpose, topics, documents to show, interviewer and
note taker, and the rights to be explained (voluntary nature for
witnesses, representation where applicable, confidentiality). Interview
witnesses before the subject. Use open questions first, then specific
questions, then put the evidence. Record the interview with consent or
take verbatim notes, and offer the interviewee the chance to review and
sign. Record refusals and the reason given. Never promise outcomes or
make threats, and stop and seek legal advice if an interview reveals a
possible criminal offence by someone not yet considered.

After each interview, the note taker completes the record the same
day, the interviewer checks it, and both sign it. Store recordings and
transcripts as exhibits under section 6. Where the interview is held in
another language, use an independent interpreter and record the
interpreter's name. Keep a separate log of contacts with the subject's
representative and of any documents the subject provides, because these
often become evidence in later proceedings.

| Interview ID | Interviewee (role or pseudonym) | Type | Date | Interviewers | Representation | Record |
|---|---|---|---|---|---|---|
| INT-01 *(Example)* | Team leader, payments operations | Witness | 2026-06-03 | [@lead-investigator], [@hr-partner] as note taker | Not requested | Signed notes |
| INT-02 *(Example)* | Second approver colleague | Witness | 2026-06-04 | Same | Not requested | Signed notes |
| INT-03 *(Example)* | Head of operations (report owner) | Witness | 2026-06-05 | Same | Not requested | Signed notes |
| INT-04 *(Example)* | E1 | Subject | 2026-06-18 | [@lead-investigator], [@legal-counsel] | Union representative present | Recording with consent, transcript |

Summary of the subject interview *(Example)*: E1 confirmed knowing A1 as
a relative living at the same address. E1 initially said the transfers
corrected booking errors, then, when shown that the source accounts had
no booking errors and that no customer instruction existed, declined to
comment further. E1 did not suggest that anyone else used the user ID.

## 8. Analysis and findings

<!-- Guidance: Purpose: state each finding, the evidence that supports it and its strength. Consider and rule out innocent explanations. Pitfall: findings that go beyond the evidence, or that rely on the subject's silence alone. -->

Present findings in the order of the mandate questions. For each, give
the fact pattern, the exhibits relied on, the alternative explanations
considered and why they were rejected, and the evidence strength. Use a
consistent scale: established (supported by reliable evidence with no
credible alternative), probable (more likely than not), not established.

| Finding | Description | Exhibits | Alternatives considered | Strength |
|---|---|---|---|---|
| F-01 *(Example)* | 14 manual transfers, EUR 179,500, from nine dormant accounts to three accounts of A1, 2025-10-06 to 2026-04-28, without customer instruction or business reason | EX-001, EX-005 | Booking corrections: rejected, no errors on source accounts | Established |
| F-02 *(Example)* | Transfers executed under E1's user ID from E1's workstation; badge data place E1 in the building for 12 of 14; 2 executed by remote session from E1's laptop | EX-002, EX-003, EX-004 | Shared credentials: no resets, no concurrent sessions, E1 not absent | Established for 12, probable for 2 |
| F-03 *(Example)* | A1 withdrew or transferred onward EUR 138,200 within days; EUR 41,300 remained and was frozen | EX-001 | A1 unaware: A1's onward transfers included payments to E1's credit card | Established |
| F-04 *(Example)* | No other employee made similar transfers in 24 months | EX-001 analytics | Not applicable | No evidence of others |

Report writing standards for this section:

- Write in the past tense and in the order the events happened. Give
  dates, amounts, account and exhibit references for every statement of
  fact, so a reader can trace it to the evidence.
- Keep opinions out of the findings. Where the investigator draws an
  inference (for example about who sat at a workstation), say that it is
  an inference and what it rests on.
- Report exculpatory evidence as fully as incriminating evidence. A
  report that omits facts favourable to the subject loses credibility
  with disciplinary panels, courts and regulators.
- Use pseudonyms (E1, A1) in the body and keep the key to names in a
  restricted annex, so the report can be shared more widely if needed.
- Describe what the investigation could not do (data that no longer
  existed, people who declined interview) and how that limits the
  findings.

Transfer summary:

| Period | Transfers | Amount (EUR) |
|---|---|---|
| 2025-Q4 *(Example)* | 5 | 58,200 |
| 2026-Q1 *(Example)* | 6 | 79,600 |
| 2026-04 *(Example)* | 3 | 41,700 |
| Total | 14 | 179,500 |

## 9. Loss quantification

<!-- Guidance: Purpose: measure the loss on a stated basis and show recoveries separately. State whether amounts are confirmed or estimated, and the date. Pitfall: netting an insurance claim that has not been accepted, which understates the loss. -->

Quantify the gross loss (funds taken), customer remediation, direct
investigation and remediation costs, and recoveries, each with its basis
and status. Treat expected insurance recoveries as contingent until the
insurer accepts the claim; accounting recognition of a reimbursement
follows the applicable standard (for IFRS reporters IAS 37, named only)
and must be agreed with finance. Record the event in the operational loss
database using the Operational Loss Event Report
(`finance/operational-loss-event-report`).

All amounts in EUR, as of 2026-07-24.

| Item | Amount | Basis | Status |
|---|---|---|---|
| Gross loss: unauthorised transfers | 179,500 | F-01, EX-001 | Confirmed |
| Customer remediation (balances restored to nine customers) | (included in gross loss) | Balances of 179,500 restored 2026-05-29 from bank funds; not added again | Paid |
| Investigation costs: external forensics | 31,000 | Invoices | Confirmed |
| Investigation costs: internal time | 7,500 | Time records at standard cost | Estimate |
| Total cost before recoveries | 218,000 | 179,500 + 31,000 + 7,500 | |
| Recovery: frozen funds in A1's accounts | (41,300) | F-03, released to bank by court order | Confirmed |
| Recovery: crime insurance claim | (113,200) | 179,500 - 41,300 - deductible 25,000; costs not covered | Contingent, claim filed |
| Net loss | 63,500 | 25,000 deductible + 38,500 costs | Estimate |

If the insurance claim fails, the net loss rises to
EUR 176,700 (218,000 - 41,300). Show both figures to the sponsor so the
decision on further civil recovery against E1 and A1 is informed.

## 10. Control failures and root cause

<!-- Guidance: Purpose: explain why the fraud was possible and why it was not detected sooner, so remediation fixes causes. Use the fraud risk assessment as the baseline. Pitfall: concluding "human error" or "rogue employee" without asking why controls allowed it. -->

For each control that failed or was missing, describe the design gap or
operating failure and the underlying cause. Link each to the risk and
control in the Fraud Risk Assessment (`compliance/fraud-risk-assessment`)
and, where relevant, to the Risk and Control Matrix
(`compliance/risk-control-matrix`) and the operational risk RCSA
(`finance/operational-risk-rcsa`). Consider incentives and pressure,
opportunity and rationalisation, but keep the analysis to observable
facts.

| Control ID | Control | Failure | Root cause |
|---|---|---|---|
| CTL-07 *(Example)* | Second approver for manual internal transfers | Design gap: required only from EUR 15,000; all 14 transfers below it | Threshold set in 2019 for efficiency; never reassessed against fraud risk |
| CTL-12 *(Example)* | Daily dormant-account reactivation report reviewed by head of operations | Not operating: report emailed to a shared mailbox, no evidence of review in 2025-2026 | Ownership lost in 2025 reorganisation |
| CTL-15 *(Example)* | Conflict of interest declaration of related customers | Not effective: E1 did not declare A1; no data match between staff and customer addresses | Relies on self-declaration only |
| CTL-21 *(Example)* | Fraud analytics on internal transfers | Missing: dormant-to-active transfers not in scope | Analytics focused on external fraud |

## 11. Remediation and recommendations

<!-- Guidance: Purpose: agree actions with owners and dates, covering people, process, systems and recovery. Pitfall: actions limited to the individual case, leaving the same gap for the next person. -->

| Action ID | Recommendation | Owner | Due | Status |
|---|---|---|---|---|
| REM-01 *(Example)* | Require a second approver for all manual transfers from dormant accounts, regardless of amount | [@head-operations] | 2026-08-31 | Done |
| REM-02 *(Example)* | Move reactivation report into a workflow with named reviewer and evidence of review | [@head-operations] | 2026-09-30 | In progress |
| REM-03 *(Example)* | Monthly data match between employee addresses and customer accounts receiving internal transfers | [@fraud-analytics] | 2026-10-31 | Open |
| REM-04 *(Example)* | Add dormant-account and staff-linked transfer rules to fraud analytics | [@fraud-analytics] | 2026-12-31 | Open |
| REM-05 *(Example)* | Look-back on all manual transfers from dormant accounts, 5 years | [@internal-audit] | 2026-11-30 | Open |
| REM-06 *(Example)* | Pursue civil recovery and support criminal proceedings | [@legal-counsel] | Ongoing | Open |
| REM-07 *(Example)* | Update fraud risk assessment for insider manipulation of dormant accounts | [@head-fraud-risk] | 2026-09-30 | Done |

Internal audit validates closure of High actions and reports to the
audit committee; see Internal Audit Engagement
(`compliance/iia-internal-audit-engagement`).

## 12. Reporting, referrals and disclosures

<!-- Guidance: Purpose: record every report made inside and outside the organisation, with date and reference, so obligations are visibly met. Pitfall: forgetting feedback to the whistleblower, or disclosing details to staff who do not need them. -->

Internal reporting goes to the sponsor, and a summary goes to the audit
committee. External reporting depends on the facts and the jurisdiction:
financial intelligence unit, police or prosecutor, supervisor, insurer,
data protection authority where personal data was compromised, and
affected customers. Give feedback to the whistleblower within the
statutory period without disclosing personal data of others. Keep all
communication factual and consistent with the report. Keep this log
open after the final report is issued and add later entries (audit
committee, supervisor updates, whistleblower feedback) as they occur.

| Recipient | Purpose | Date | Reference | Sent by |
|---|---|---|---|---|
| Investigation sponsor | Final report | 2026-07-24 *(Example)* | FI-2026-009 v1.0 | [@lead-investigator] |
| Audit Committee | Summary report | 2026-09-10 *(Example)* | AC paper 2026-09-07 | [@chief-audit-executive] |
| Financial intelligence unit | Suspicious transaction report | 2026-05-21 *(Example)* | [restricted] | [@mlro] |
| Police | Criminal complaint | 2026-07-22 *(Example)* | [Crime reference] | [@legal-counsel] |
| Supervisor | Incident notification and update | 2026-06-02, 2026-08-05 *(Example)* | [Reference] | [@head-compliance] |
| Insurer | Claim | 2026-07-20 *(Example)* | [Claim number] | [@insurance-manager] |
| Affected customers | Balances restored, explanation | 2026-05-29 *(Example)* | Letter template approved by legal | [@customer-care] |
| Whistleblower | Feedback on follow-up | 2026-08-05 *(Example)* | WB-2026-031 | [@whistleblowing-officer] |

## 13. Glossary and references

<!-- Guidance: Define terms for non-specialist readers such as board members. Cite laws by number; frameworks of professional bodies by name only. -->

Glossary:

- **Predication**: circumstances that justify starting an investigation.
- **Chain of custody**: the documented history of who held an item of
  evidence, when and why, from collection to presentation.
- **Legal hold**: an instruction to suspend deletion of data that may be
  relevant to an investigation or litigation.
- **Exhibit**: an item of evidence with a unique ID.
- **Subject**: a person whose conduct is under investigation.
- **Gross loss / net loss**: loss before and after recoveries.
- **Legal privilege**: protection of certain lawyer communications from
  disclosure, with conditions that vary by country.

References (as of 2026-10; check the current official versions):

- GAO, A Framework for Managing Fraud Risks in Federal Programs,
  GAO-15-593SP (2015), US public domain.
- Directive (EU) 2019/1937 on the protection of persons who report
  breaches of Union law, Articles 9, 16 and 19, as transposed.
- Regulation (EU) 2016/679 (GDPR), Articles 6 and 10.
- UK Economic Crime and Corporate Transparency Act 2023, section 199
  (failure to prevent fraud), in force 2025-09-01, and Home Office
  guidance.
- Association of Certified Fraud Examiners (ACFE), professional
  standards and Fraud Examiners Manual, named only; COSO and ACFE Fraud
  Risk Management Guide, second edition (2023), named only.
- ISO/IEC 27037 (digital evidence identification, collection,
  acquisition and preservation), named only.
- Related templates: Fraud Risk Assessment
  (`compliance/fraud-risk-assessment`), Whistleblowing Policy
  (`compliance/whistleblowing-policy`), SAR/STR Narrative
  (`compliance/sar-str-narrative`), Operational Loss Event Report
  (`finance/operational-loss-event-report`), Incident Response Plan
  (`compliance/incident-response-plan`), Design Fraud Detection
  (`system-design/design-fraud-detection`).

## Standard and licence note

Structure aligned with common fraud examination practice; the ACFE,
COSO and ISO/IEC 27037 materials are protected by copyright and are cited
by name only, with no text reproduced or paraphrased. Legal references
are based on the GAO Fraud Risk Framework (US public domain), EU law
(Directive (EU) 2019/1937, Regulation (EU) 2016/679, EUR-Lex) and UK
legislation, described in original wording. The template text, scales
and the Fernhollow Bank case are original and fictional; no real person
or company is described. Check the current official texts and national
law, especially employment and data protection law, before use. This is
a document format, not legal, accounting or employment law advice.
Template licence: MIT.