Preserve First, Investigate Second
When a company receives a fraud allegation, the first useful move is usually controlled preservation—not a surprise confrontation. Relevant email, accounting records, access logs, contracts, expense files, chat messages, and physical documents can be altered through ordinary retention cycles even when no one intentionally destroys them. Counsel and information-security personnel should identify likely custodians, systems, backups, and access risks before the suspected conduct is disclosed broadly.
Preservation should be documented and proportionate. Record who collected an item, where it came from, its native format, and whether a copy or original is being retained. Do not “clean up” a suspicious spreadsheet, forward every file through personal email, or ask employees to search a suspect's device without confirming authority and procedure. The U.S. Department of Justice's corporate prosecution guidance recognizes the importance of relevant facts, records, source attribution, and internal investigations while distinguishing factual material from privileged work.
A private investigator can support this process, but the company and its lawyers determine legal holds, privilege, employment action, disclosure duties, and regulator or law-enforcement contact. This article is general information, not legal advice.
Turn an Allegation Into Testable Questions
“The controller is stealing” is an allegation, not a scope. A useful investigation breaks it into transactions and decisions: Were duplicate vendors created? Did invoice addresses, bank details, or approvers change? Were refunds diverted? Do purchase orders match receipt records? Did one user repeatedly override controls? Are inventory losses concentrated by item, shift, or location? Which records would confirm an innocent explanation?
Financial anomalies are red flags, not proof of intent. A duplicate payment can result from a migration error; after-hours access may reflect a deadline; an unfamiliar vendor may be legitimate. The plan should define the relevant period, business process, potential loss, decision-makers, and objective comparison population. It should also state when the team will pause, expand, or refer the matter.
Florida's theft statute, section 812.014, includes knowledge and intent elements. Investigators document conduct and source facts; they do not declare that a person committed a crime. Counsel and the authorities make legal assessments from the complete record.
Records and Interviews Need a Lawful Plan
A corporate investigation may use authorized company records, appropriate public records, source interviews, and limited field observation. Before accessing workplace systems, confirm ownership, acceptable-use notices, role-based permissions, collective-bargaining terms if any, and state or federal privacy restrictions. A PI license does not authorize hacking, pretexting for protected financial data, opening personal accounts, or bypassing access controls.
Interviews should follow the documents rather than substitute for them. Prepare a neutral chronology and open questions; identify who the interviewer represents; avoid promises the company cannot keep; and memorialize the source's words separately from the investigator's analysis. Interview order matters when witnesses may coordinate stories or when an early contact could cause records to disappear.
Retaliation risk also deserves counsel review. Federal and state protections vary by subject and circumstance. For example, the U.S. Department of Labor explains FLSA anti-retaliation protections for complaints and cooperation in investigations. A fraud inquiry should not become a vehicle for punishing a reporter, witness, or employee engaged in legally protected activity.
Know When to Involve Counsel or Authorities
Outside counsel should often direct matters involving executives, possible litigation, regulatory reporting, cross-border data, whistleblowers, trade secrets, employee discipline, or a meaningful risk of criminal conduct. Counsel can define privilege, manage preservation and discovery duties, and decide whether voluntary disclosure is appropriate. Calling an investigation “privileged” does not automatically make every underlying fact or business record privileged.
Immediate safety threats, active account compromise, or ongoing loss may require parallel containment. Preserve logs before resetting access when feasible; separate operational containment from fact-finding; and keep a decision log. Do not let a private inquiry obstruct law enforcement or a regulator. If authorities become involved, coordinate interviews and evidence transfers so the company does not contaminate sources or create conflicting versions.
A licensed PI is a fact-gatherer, not a forensic accountant, employment lawyer, incident-response firm, or sworn officer unless separately qualified in that role. Good scoping assigns each discipline the work it is trained and authorized to perform.
A Defensible Report Includes Contrary Facts
The report should connect each finding to an identified source, transaction, document, or firsthand observation. It should distinguish verified facts, source statements, unresolved leads, and analysis; describe limitations; and include credible evidence that weakens the allegation. Native files and originals should be preserved, with working copies clearly identified.
No agency can guarantee that a report is “court admissible.” Florida requires evidence to be authenticated or identified sufficiently to support what its proponent claims under section 90.901, and other rules may govern relevance, hearsay, privilege, disclosure, and weight. An investigator may testify about personal work when properly called, but not about legal conclusions or specialties outside the investigator's qualifications.
Before retaining an agency, confirm its status through the FDACS license search. Emerging Investigations can help counsel or authorized company leaders define a limited fraud investigation, preserve source attribution, and report what the evidence supports—including when it does not support the original suspicion.