A hypothesis is an assumption made from something, usually data or information, that serves as the basis for starting an investigation. We can have many hypotheses and the quality of each of them will depend on the experience and knowledge of the people who generate them.
The purpose of having a hypothesis is to find an answer to a question, in this case about a fraud
In order to be able to answer the question, we must gather as much data as we can and convert it into information that will help us resolve the hypothesis. This does not necessarily indicate that fraud is being committed, but also the opposite, that fraud is not being committed.
The hypothesis and forensic analysis
Anticipating a forensic process, fraud investigators must create the hypotheses of the investigated case, in such a way that ideas emerge from the paths to its resolution that allow expanding the spectrum of possibilities in terms of acquiring digital evidence from various sources. The entire investigative team must have critical thinking that ensures that all options, including the possibility of innocence of the alleged perpetrator, are on the table.
The elaboration of many hypotheses allows covering a wide range of possibilities for the acquisition of evidence, however, it is important that many of these hypotheses are refined by the team of researchers to focus on the most rational ones.
How hypotheses are resolved
Once the hypotheses of the event have been refined, certain aspects must be taken into account that will help to resolve them:
Assume it will end in litigation: Every investigation should begin with the belief that the case will end in litigation. From the beginning to the end of the investigation, this premise must be maintained and this will allow the investigator to conduct the examination according to appropriate rules for the treatment of evidence and each action supported by a legal framework.
Act on the predicate: No matter what kind of investigation it is, you must adhere to the law and conduct it with an appropriate predicate. The predicate is the totality of circumstances leading to a reasonable, professional, and prudent belief that fraud has occurred or will occur. If you act without a predicate, you may be conducting unfounded research, generating hypotheses that are difficult to resolve, and even getting involved in legal problems.
Having two perspectives: Investigators must act from two perspectives (1) prove that the fraud occurred (2) prove that the fraud did not occur. The reason behind these two perspectives is that both sides must be examined because investigations are not necessarily carried out on events that happened but on those that did not happen.
Move from the general to the specific: investigations begin when the facts are unknown. The examiner should first address the general information that is known and then move on to that which is unknown and may be more difficult to obtain, for example, first interviewing neutral witnesses, then the parties involved, and finally the prime suspect.
Use the fraud triangle theory: when conducting an investigation, you must take into account the Fraud Triangle theory and adhere to a methodology to address it, remember that this theory focuses on elements of pressure, opportunity and justification that could help build the hypothesis of why someone would commit fraud in the organization.
One must always act based on the premise that the case will end in litigation, in such a way that it is taken for granted that each action that is executed must be supported and explained in a legal process. This implies that the data and information that we collect to develop the hypotheses must be supported by the legality of their acquisition methods.
Quality assumptions
A missing $270 dollars has just been found. What could have happened?, an accounting auditor will generate his hypotheses based on his experience, a cyber-investigator will generate others, an occupational fraud investigator will arrive with a more open range and the people inside the organization who discovered the lack will add more hypotheses to the case. If we have specialized professionals we can have better hypotheses, very close to what could have really happened.
If we have a suspicion of fraud due to the occurrence of some suspicious and unfortunate event, the best thing we can do is go to specialists in the field to generate quality hypotheses that can later be quoted for resolution.
References
(Auditool, 2018) Digital Forensic Audit Course
About NOFRAUD
NOFRAUD is the company that develops The Fraud Explorer anti-fraud software and supports individuals and companies to face and solve their challenges regarding internal fraud, corruption and corporate abuse. NOFRAUD has created the largest behavioral database of dishonest acts in the world in Spanish and English, which is used by artificial intelligence to find suspicious patterns of corruption within organizations.
We enhance the ability of organizations to increase their profits by removing the possibility for perpetrators to negatively affect revenues through fraud, corruption, corporate abuse and the creation of toxic environments.
Contact me at » jrios@nofraud.la and Visit our site » www.nofraud.la.