Fraud audit: from suspicion to report

Large and small companies alike are sometimes confronted with suspected fraud in their ranks, and want above all to know what exactly happened. Our specialists have years of experience with this type of enquiry and work closely with both internal and external fraud auditors. Stijn De Meulenaer is himself an accredited Registered Fraud Auditor and a board member of the Institute of Fraud Auditors. Together with you, we establish what is legally possible, and we guide the audit within your company.

If you investigate in house, your personnel department sits under lighter rules than an external agency. If you still engage an external agency, check its licence first: Article 8 of the Act of 18 May 2024 regulating private investigation forbids the use of an unlicensed firm, and Article 101 prescribes that rule on pain of nullity. Your own personnel department carrying out an incident enquiry against your own employees needs neither a licence nor an identification card, though the other rules of the Act still apply.

Evidence you gather during the audit remains subject to Article 32 of the preliminary title of the Code of Criminal Procedure. The court admits evidence gathered irregularly, unless a formality prescribed on pain of nullity has been breached, the reliability of the evidence has been affected, or the right to a fair trial has been infringed. Our team once guided the internal fraud department of a major Belgian bank, which suspected a staff member of stealing office supplies. We provided legal guidance on the evidence gathering, on the basis of which the fraud was established and the necessary remediation followed.

A fraud audit examines a concrete suspicion that has already arisen within your company. Our anti-fraud audit does the opposite: it reviews your internal controls in advance, before any suspicion exists, and results in recommendations to prevent fraud. The two services complement each other, but serve a different moment in the process.

If you carry out the audit together with external fraud auditors or in-house investigators, we also guide that process through our guidance on private investigations. Any company that organises its own internal department for private investigation must also appoint a data protection officer, in house or under an agreement with an external one. Record the purpose and the retention period for the results, before the enquiry starts, in the record of processing activities the GDPR requires.

If the audit confirms that fraud actually took place, we discuss which route suits best: a fraud investigation into the exact scale of the facts, or moving straight to damage recovery for the loss suffered. This service forms part of our wider support for victims of fraud, where you also find the other steps after a finding.

Your own personnel department may carry out incident enquiries against your own employees, without a licence and without an identification card. Article 43 of the Act of 18 May 2024 regulating private investigation makes that exception expressly. The other rules of the Act still apply, including the duty to report to the public prosecutor once the facts are clear. If you still engage an external agency, check its licence first, because without a licence the evidence is void.

Sometimes yes, because a Belgian criminal court may admit evidence gathered irregularly, except in three cases. Article 32 of the preliminary title of the Code of Criminal Procedure excludes it only for a formality prescribed on pain of nullity, an irregularity affecting the reliability of the evidence, or a breach of the right to a fair trial. An enquiry carried out without the required licence falls under the first exception. We therefore check in advance whether your evidence gathering meets the legal conditions.

We then discuss together which route suits best, from a fraud investigation into the exact scale of the facts to damage recovery for the loss suffered. Where further criminal action proves necessary, we also represent you before the council chamber and the criminal court. Our specialists weigh the civil route against the criminal route, depending on your case. You then choose the approach that leads fastest to recovery.

Any company that organises its own internal department for private investigation must also appoint a data protection officer, in house or under an agreement with an external one. Record the purpose and the retention period for the results, before the enquiry starts, in the record of processing activities the GDPR requires.