Forensic investigations: the vitality of due process and the promise of AI (with care)

Fraud is among the most challenging crimes to combat in a large organisation. To stop fraudulent activity at the source, large organisations rely on a combination of anti-fraud legislation and internal policies and procedures. These measures equip organisations to understand fraud, enabling them to prevent fraud at the source. Through this process, organisations create an environment which forces a perpetrator to produce a natural or digital paper trail of activity.

Simply put; to commit fraud, a perpetrator must take written action (digital or otherwise) to benefit from whatever loopholes they seek to exploit. When fraud is discovered, this audit trail is the focus of forensic investigation. A forensic investigation aims to paint a picture of what happened by gathering facts and information to report in detail on the facts in question.

The importance of fair process when gathering forensic evidence

In any forensic investigation, the quality of the outcome is always dependent on the quality of the inputs received. These inputs are reflected in several key categories:

• The scope of the investigation and the resources available to conduct it;
• The process followed to gather the evidence; and
• To what degree investigators are provided with the relevant information to conduct the investigation.

For example, a person subject to a fraud investigation is understood to have used his personal device to log into company systems as part of their role. The data on the device is likely valuable to the investigation, as it can provide a history of activity and decision-making that either helps prove or disapprove the allegation. However, because the device is the personal property of the accused, they have the right to refuse to share it with investigators, citing invasion of privacy, subject to any applicable company policies.

An alternative to gaining access to the electronic data on a personal device is for the investigator to search for the data on the company data server, as it is owned by the organisation rather than the private individual. The record of the investigation will show that a request was made to the accused to provide their personal device, but the accused refused. Because the accused refused, it created a justification for investigators to search for the data needed in the company’s servers.

The above description may appear frivolous at worst or pedantic at best to external observers. Still, every action within a forensic investigation should be recorded so that it can sustain itself against procedural and judicial scrutiny. An inquiry may attain a document or data that irrevocably proves the guilt of an accused person, but if that document or data was attained in a way that contravened the law or internal policy, it will become inadmissible as evidence.

Technology is increasing investigation efficiency

The way fraud investigations have changed is mirrored by the way technology has changed society’s way of work. Up to the late 2000s, forensic investigations dedicated a significant portion of their time to gathering physical documents as evidence, with these documents kept on site. Today, physical documents have been replaced by servers and digital assets, including instant messaging, email, Word documents, Excel spreadsheets and more.

While the digitisation of forensic investigations has occurred over the last ten to fifteen years, the last five years, if not fewer, have seen artificial intelligence increasingly playing an important role. Tools have now been developed that leverage natural language processing and machine learning so that investigators can process large batches of data faster and with increased accuracy. A task that may have taken several hours can now be done in a fraction of the time.

Yet, using AI within the forensic investigative process can create false confidence in organisations that do not have the necessary skills and expertise to use it. AI’s promise in the investigative process can only be achieved if the inputs provided are of sound quality and attained in the correct manner. If an AI tool is fed poor or irrelevant data or asked to search for irrelevant keywords, the output will be inherently flawed.

Conducting a forensic investigation is complex and multi-layered. It can stretch across an organisation, lead to unforeseen outcomes, and demand a level of rigour that requires full-time commitment, expertise, and discipline. Conducting it also requires time and capital, which is an unattractive option for organisations, even for organisations with the resources to employ specialised investigative services.

We have worked with clients who, in effect, asked us to conduct a second investigation on the same fraud incident because their first investigation may have had structural flaws from the outset. Our advice to clients is to always consider the breadth and scope of the investigation they wish to conduct and the importance of reaching a fair outcome that withstands judicial scrutiny.

Time spent executing a forensic investigation is, in many respects, time well used. The greater the level of detail in an investigation, the more likely the outcome will produce a fair result for all parties and allow a matter to be closed.

​Lionel Van Tonder is a Director at Webber Wentzel

Danniel Kruger it a Senior Forensic Manager at Webber Wentzel