Step 3: Investigation

The goals of investigations of potential misuse are to determine if the allegations of misuse are valid, then to identify control weaknesses or breakdowns in procedure that allowed the situation and any related problems to occur, determine the extent of any loss and recommend corrective action to prevent the situation from recurring.

The type of investigative procedures used will depend on the nature of the potential misuse and the results of the preliminary review.

The investigation may stop with the preliminary review if that shows the allegations are not valid, or if the issues are minor and can be resolved through meetings with management of the area involved.

If the allegations are found to be valid, the investigation may involve complex analyses of processes, reviews of access capabilities, and extensive tests of records.

There may be a need to extend the review into areas and activities not identified in the initial complaint. An auditor performing a misuse investigation must exercise considerable judgment in selecting the type and extent of procedures to be performed.

The two most important steps in the investigative process are:

•determining where the allegations are likely to be valid and

•identifying control weaknesses that allowed any misuse to occur.

If allegations are clearly invalid, there is no need to perform extensive work to investigate them. We need to understand how a loss occurred and what weaknesses are involved in order to know what we should investigate and how. Investigations of potential misuse must be conducted in a confidential manner and with respect for the rights of the individual involved. Whenever possible, Internal Audit will notify appropriate members of management prior to beginning an investigation. Advance notice may not be possible in rare situations when even a small delay could allow additional funds to be lost or records destroyed. In these situations, Internal Audit will notify management as soon as possible after the investigation begins.

If allegations involve possible misuse by management of an area, Internal Audit will coordinate any investigation through an organizational level to which this area reports.

If an investigation reveals a potential violation of any federal, state, or local law, we will consult with the Office of General Counsel for guidance. If appropriate, we will also obtain guidance from the Public Safety.