To begin gathering evidence and building a case, companies should take the following steps.
It all starts with notifying and obtaining advice from your in-house counsel on what is needed to get the investigation started, ranging from who takes the lead and the extent of the said parties’ involvement in the investigation.
Next, secure potential evidence. The methods of doing so will vary based on how and where the data is stored. For electronic data, IT departments generally have neither the
equipment nor the expertise to collect and secure evidence. For example, accessing the electronic data runs the risk of altering or deleting data, and if such data is altered, it may not be admissible. To make sure that anything collected will be admissible in court
if needed, engage a computer forensics expert if you do not have the in-house capabilities for data collection.
At a minimum, you should consider securing the following electronic data from the following sources by imaging them and setting them aside:
» Email servers and email backup tapes;
» Company mobile devices – done in conjunction with company policy and applicable law - of key suspects, such as procurement, finance, and general management staff (such devices include, but are not limited to, mobile phones, digital assistants, tablets, and similar equipment); and
» Company laptops or other electronic equipment used by suspect employees.
Finally, any paper-based key procurement and contract data such as supporting invoices, receipts, bills, and delivery acknowledgements from the alleged perpetrator’s tenure with the company need to be secured.
Once the relevant evidence is secured, an investigation into the allegation itself is required. If there is no in-house expertise to address this, the option would be to hire external consultants.
Data analysis of the company’s financial records may shed light on vendors that have been favored since joining the company.
If there is a broad audit clause in place with your suppliers, this data analysis could expose and bring to light the approved supplier’s transactional data. Suppliers willing to pay kickbacks, though, are unlikely to agree to the incorporation of such an audit provision in their agreement.
Finally, data analytics can help identify relevant statistics about vendors, such as the degree to which the amount of business they have been given has increased over a certain period of time. Significant increases indicate those most likely to have paid kickbacks. You will need to review transactions with such vendors thoroughly, including the bidding process, the award, the contractual arrangements, the unit prices and the quality of services or goods delivered. Data analysis is usually a very effective way of spotting inappropriately favored vendors.
Background searches on these vendors are often useful in obtaining information such as financial statements, ownership structure, litigation records, and overall reputation. Such searches on suspected employees may also be a valuable source of data.
If there is conclusive information pointing to an employee’s involvement, an asset tracing exercise can be carried out as well. While only indicative, if the employee is found guilty,such information will be useful in any recovery actions.
You will also need to identify any vendors who have seen a significant decrease in business or have been removed from the vendor database during the alleged perpetrator’s tenure with the company. These rejected vendors who have seen a drastic drop of their revenue at your company may have complaints regarding favoritism and
biased procurement processes against the company’s procurement ethics. They can be
approached for informal discussions or interviews and discreet enquiries to find out
why they are disgruntled. Frequently whistleblowers come from this pool.
More often than not, kickbacks are arranged through in-person meetings and the only evidence a company may find will be in emails, text messages, or calendars – both electronic and paper. This is why it is important to scrutinize the latter for suspicious meetings. Surveillance of these meetings, where legally permissible, can also provide pertinent information on the individuals involved.
Finally, desk and office searches often reveal modus operandi: the beneficiaries of bribes,their amount and nature, and even where the money is kept. For example, a email will give you some information of the meeting being set up, a calendar invite could then reveal who was present at the meeting, payment records can confirm that an inadequate payment was made and background searches on the payment receiver could expose that the payment was given to a relative of a meeting attendee.
The combined analysis of paper and electronic data, procurement records, discreet enquiries with vendors (no longer being favored), and background searches will give you a good understanding of what, if anything, is going on and who might be involved.
Rather than relying only on investigations, because vendor kickbacks schemes are very difficult to detect, companies need to focus on mitigating the risk before it happens by
implementing whistle blower initiatives not only for employees but also for vendors and
customers; implementing an iron-clad procurement process; having a strong tone at the top; regularly rotating procurement staff; and employing robust pre-employment screening policies.