By The Falcon Consulting Group
The email comes in on a Tuesday afternoon. A controller has noticed payments to a vendor nobody recognizes. Or an employee calls the hotline about a manager who has been approving his own expenses. Or a customer forwards an invoice that does not match anything in the system.
What happens over the next three days will decide what the company can prove six months from now. Evidence is either preserved or it is not. The work is either structured for privilege or it is not. The person who reported either trusts the process or starts talking to a regulator.
Tips are not a rare event, either. The Association of Certified Fraud Examiners’ 2024 Report to the Nations found that 43% of occupational frauds were detected by a tip, more than any other method, and that more than half of those tips came from employees.
None of that requires the company to know yet whether the tip is true. It requires the company to act as though it might be, in the right order.
This post is about that order. Once the facts start coming in, the question becomes whether the matter needs a forensic team rather than internal audit, which we cover in our post on when to call a forensic accountant versus your internal audit team.
Why Do the First 72 Hours Matter So Much?
Because the evidence that matters most is also the easiest to lose. Email is subject to retention settings. Text messages live on personal phones. Accounting entries can be edited or reversed. A person who senses they are under suspicion has every reason, and usually the access, to clean things up.
The first days also set the legal frame for everything that follows. If the investigation starts as an informal management inquiry, the notes, interviews, and early conclusions may not be protected later. If it starts under the direction of counsel, much of that work can be.
Finally, the first days are when the company’s notice obligations start running. Crime and fidelity insurance policies typically require prompt notice once a loss is discovered. Public companies may face disclosure questions. A company that waits to “see if it is real” can find that the waiting itself has cost it coverage or credibility.
Hour 0 to 24: Contain and Preserve
The instinct is to start asking questions. The right first move is to stop anything from disappearing.
Issue a legal hold
A legal hold is a written instruction to the people and systems likely to hold relevant records: do not delete, alter, or discard anything related to this subject. Once litigation or an investigation is reasonably anticipated, the duty to preserve generally attaches. Courts can sanction the loss of electronically stored information that should have been preserved, and Federal Rule of Civil Procedure 37(e) allows severe measures where the loss was intentional.
The hold does not need to name the suspected employee or describe the allegation. It needs to identify the categories of records and the custodians.
Suspend auto-delete
Most companies run email and messaging platforms with automatic deletion. IT should suspend those settings for the relevant custodians immediately. This is a quiet administrative step that rarely tips anyone off.
Image before anyone is interviewed
Laptops, phones, and shared drives should be forensically imaged by someone qualified to testify about how it was done. A forensic image preserves deleted files, metadata, and timestamps that an ordinary copy does not. If the subject’s device is company owned, it can usually be imaged during a routine “IT update” without confrontation.
Lock down financial access
If the tip involves payments, restrict the suspected person’s ability to approve, create vendors, or move money. Do it in a way that looks routine. Changing approval thresholds across a department draws less attention than removing one person’s access.
Hour 24 to 48: Structure the Investigation
Bring in outside counsel now, not later
The attorney-client privilege and the work-product doctrine are what keep an investigation’s findings from becoming a roadmap for a plaintiff or a regulator. Those protections depend on the investigation being conducted for the purpose of providing legal advice. Courts look at who directed the work and why.
In-house counsel can direct an investigation, but outside counsel usually provides cleaner separation, especially where senior management may be involved. When forensic accountants or investigators are engaged, they should generally be retained through counsel so their work falls inside that structure. We cover how that retention affects later discovery in our post on consulting experts versus testifying experts.
Decide who is on the team and who is not
Anyone who might be implicated, anyone who reports to the subject, and anyone with a stake in the outcome should be kept out of the working group. That often includes people who would normally run an inquiry, like the CFO in a finance matter.
Write down the scope
A short scoping memo, prepared by or for counsel, defines what is being investigated, over what period, and what questions need answers. It keeps the work focused and is itself evidence that the company responded deliberately rather than reactively.
Hour 48 to 72: Protect the Reporter and Plan the Next Phase
Protect the person who reported
If the tip came from an employee, that person now has legal protection. Federal law protects many reporters of fraud at public companies, and the SEC’s whistleblower program gives them a direct line to regulators. New Jersey’s Conscientious Employee Protection Act (CEPA) is one of the broader state whistleblower statutes in the country, covering employees who object to or report conduct they reasonably believe is unlawful.
Retaliation claims are often easier to prove than the underlying fraud, and they can outlast it. A reporter who is suddenly reassigned, excluded from meetings, or given a poor review shortly after a complaint has the beginning of a case. Tell the reporter the matter is being taken seriously, give them a contact, and make sure their manager knows that nothing about their role changes.
Notify the insurer
Read the crime or fidelity policy now. Most require notice within a set period after discovery of a loss, and “discovery” can be interpreted earlier than the company expects. A short notice letter preserving the claim costs nothing. A late notice can cost the entire recovery.
Plan interviews, but do not hold them yet
Interviews come after the documents, not before. Investigators who interview first end up asking questions they cannot test against the records, and they give the subject a preview of what the company knows. We cover how interviews should be conducted, including the warnings counsel must give, in our post on Upjohn warnings and employee interviews.
What Should a Company Not Do in the First Days?
Most of the damage in a failed investigation is done early, by well-meaning people moving fast. These are the mistakes we see most often:
Confronting the subject. A manager who calls the suspected employee in “to hear their side” has just told them to start deleting. The confrontation should come last.
Running it through the chain of command. If the subject reports to a vice president, that vice president should not run the inquiry. Even where the supervisor is uninvolved, their notes and emails are unlikely to be privileged.
Letting IT investigate on its own. IT can preserve. It should not start searching mailboxes and forwarding results by email. That creates unprotected records of what the company looked at and what it concluded.
Firing too fast. Terminating a suspected employee in the first week ends their access, but it also ends their cooperation, can trigger the destruction of personal records, and can look retaliatory if the facts turn out differently. Administrative leave is usually the better tool.
Talking about it. Every email that speculates about guilt is a document that may be produced later. Discussion should happen with counsel, not on Slack.
When Does the Company Need to Think About Self-Reporting?
Not in the first 72 hours, but the first 72 hours determine whether self-reporting stays a real option. In March 2026 the Department of Justice issued its first department-wide corporate enforcement and voluntary self-disclosure policy. Companies that voluntarily self-disclose, fully cooperate, and remediate can receive a declination. That credit depends on timing and on the company being able to show what it found and when.
The clock can be short. Under the new policy, a company that receives an internal whistleblower report generally has to self-report as soon as reasonably practicable, and no later than 120 days after the report, to qualify for the most favorable treatment. That window starts the day the tip lands.
A company that preserved evidence, documented its response, and ran a structured investigation is in a position to make that choice deliberately. A company that lost the email and confronted the wrong people early has fewer options.
Frequently Asked Questions
What should a company do immediately after receiving a fraud tip?
Preserve before investigating. Issue a legal hold, suspend automatic deletion, forensically image relevant devices, and restrict the suspected person’s financial access in a way that looks routine. Then bring in counsel to structure the investigation for privilege before anyone is interviewed.
Should we tell the employee they are being investigated?
Not at the start. The subject should usually be interviewed last, after documents have been secured and reviewed. Telling them early is the most common way evidence disappears.
Does an internal investigation need to be run by a lawyer?
It does not have to be, but if the company wants the findings protected by attorney-client privilege and work product, counsel should direct the work from the beginning. Forensic accountants and investigators are generally retained through counsel for the same reason.
Can we fire the employee right away?
You can, but it is often a mistake. Termination ends cooperation and can complicate recovery and any later retaliation defense. Paid administrative leave preserves options while the facts are confirmed.
Do we have to notify our insurance carrier?
Check the policy right away. Crime and fidelity policies usually require notice within a defined period after a loss is discovered. Late notice is one of the most common reasons employee theft claims are denied.
How long does an internal investigation take?
The first phase, preservation and scoping, should take days. The full investigation depends on the size of the issue and can take weeks to months. The work in the first 72 hours largely decides how long the rest takes.
The Bottom Line
A tip is not a finding. It is a starting point, and the company’s job in the first three days is not to decide whether it is true. It is to make sure that when the answer comes, the company can prove it, protect it, and act on it.
Preserve first. Bring in counsel. Protect the reporter. Interview last.
Key Takeaways
- Issue a legal hold and suspend auto-delete within the first day. Preservation is cheap early and impossible later.
- Image devices before any interview. Forensic images capture what ordinary copies miss.
- Retain outside counsel at the start, and engage forensic accountants and investigators through counsel.
- Keep anyone who might be implicated, or who reports to the subject, out of the working group.
- Protect the reporter from any change in role or treatment. Retaliation is a separate liability.
- Read the insurance policy and send notice early.
Work With Falcon Consulting Group
Falcon Consulting Group supports counsel and companies from the first call after a tip lands, including evidence preservation, forensic accounting, investigative interviews, and asset tracing.
Our forensic accounting and white collar investigation services are delivered by former federal agents and CPA and CFE certified forensic accountants who have run investigations from the first phone call through testimony. We help companies get the first 72 hours right so the rest of the investigation has something to stand on.
If a tip just landed on your desk, contact us before anyone starts asking questions.
About Falcon Consulting Group
Falcon Consulting Group is a corporate investigations and compliance advisory firm whose associates include former federal and state law enforcement personnel, former Inspector General staff, CPAs, Certified Fraud Examiners, and CAMS certified professionals. The firm supports counsel and corporate clients across forensic accounting, white collar investigations, litigation support, and regulatory compliance. Learn more about the Falcon team.