Investigating an Employee Dishonesty Claim

Based on the results of a study performed by the Association of Certified Fraud Examiners and reported in their 2002 Report to the Nation – Occupational Fraud and Abuse, the organization estimated, at that time, that six percent of revenues are lost as a result of occupational fraud and abuse.  Applied to the U.S. Gross Domestic Product, this translates to losses of approximately $600 billion, or about $4,500 per employee at the time the report was issued.

Insurance companies offer employee dishonesty coverage and pay a good portion of the billions of dollars stolen annually from insured employers by employees.  Once an employer has been paid, the respective insurer often attempts to recover their payment from the dishonest employee (depending on the policy limit and the amount of theft).  This is referred to as subrogation.

To be successful in recovering a payment from a dishonest employee in a civil trial, the plaintiff insurer must prove by a preponderance of the evidence that the defendant caused the plaintiff injury, in this case a financial injury.  The plaintiff must show the facts are more than 50 percent in their favor as opposed to the defendant’s favor.  It is the duty of the individuals investigating the claim to develop sufficient facts and evidence such that counsel for the insurer can easily establish, by a preponderance of the evidence, that the defendant owes the plaintiff.

The most important part of any insurance related employee dishonesty investigation is verifying that the suspected individual is an actual employee of the insured business.  The employee dishonesty policy covers only thefts by employees.  Thefts by independent contractors and others may be covered by a separate coverage or policy.

The purpose of this article is to discuss some of the information that should be gathered during the objective investigation of an employee dishonesty claim.  The initial goal is to determine whether or not the claim can be sufficiently documented and if so, whether the preponderance of the evidence supports the conclusion that the suspected employee is most likely responsible for the claimed misappropriation(s).

Employee or Independent Contractor?

 One of the easiest ways to determine that a suspected individual is an employee is to ask the insured for evidence that, in administrative and tax matters, the individual is treated as an employee. One key document is the most recent Federal Tax Form W-2: Wage and Tax Statement, which should show the insured as the employer and the suspected individual as the employee.  According to the Internal Revenue Service, an employer must withhold income taxes, social security taxes and medicare taxes for an employee and this information must be reported to the Internal Revenue Service and the employee on an annual basis on Form W-2.  Therefore, if you are provided a Form W-2 indicating the insured is the employer and the suspected individual is an employee, you can be certain that the suspected individual is being treated as an employee of the insured business.  Depending on the situation, you may want to verify that the Form W-2 the insured provided you was actually filed with the Internal Revenue Service and was not created by the insured in an attempt to falsely document the claim.  Reference to payroll registers will also corroborate the employment issue.  A copy of the Form W-2 actually filed by the employer can be requested by using IRS Form 4506.

If the suspected individual is an independent contractor and not an employee, the insured would be unable to provide a Form W-2.  The amounts paid to an independent contractor by a business are reported to the Internal Revenue Service on Form 1099.  If the insured provides you a Form 1099 in an attempt to satisfy the request for a Form W-2, you know the suspected individual is being treated as an independent contractor and not an employee.

As an example (based on an actual case), the employee versus independent contractor issue surfaced in the following manner in the investigation of an employee dishonesty claim involving a dentist’s office.  An individual had worked full time at the same dentist office for about 5 years as the office manager.  The individual was suspected of stealing $17,000 in cash receipts over a 5-month period.  The insured submitted a claim to the insurance company under the employee dishonesty coverage of their policy.  In the initial document request to the insured, a request was made for the suspected individual’s most recent Form W-2.  The insured provided a Form W-2, however the insured was not listed as the employer on the Form W-2.  When questioned about this, the insured indicated that they lease their employees from an employee leasing service.  The insurance company concluded that the claimed theft was not covered by the employee dishonesty policy, denied the claim and closed the file.  Although the individual appeared to be an employee, they were actually an employee of the leasing company.

Isolation of the Loss to the Suspected Employee

Another important part of an employee dishonesty investigation is isolating the theft to a specific individual.  Once the insured has provided financial documentation supporting assets were stolen from the business, you need to isolate the theft to a specific individual in order to be covered under the employee dishonesty policy.

First, you should learn what the suspected employee’s job responsibilities were, which allows you to determine what financial records the employee had access to and how the system of financial records can help in your investigation of the theft.

To isolate the loss to an employee, you should review the financial records before and after the employee’s employment to determine no thefts were occurring.

In order to successfully isolate the theft to an employee, you must determine that the thefts only occurred on days the employee worked and thefts did not occur on days the employee did not work.  You also must determine that the employee’s job responsibilities provided them the opportunity to steal and, if applicable, manipulate the financial records.

Obtain Information from the Suspected Employee

Before rendering a conclusion regarding the validity of the claim for misappropriations by a suspected employee, it is recommended (when possible) to obtain information from the suspected individual. This may be accomplished by obtaining police reports and/or interviewing the reporting officers, obtaining copies of signed statements and confessions or conducting interviews or obtaining testimony from the suspected individual. This information may tie up loose ends and lend support for the claim or may provide evidence that what appeared to be a loss to the insured is actually not a loss at all and may be explained by other information provided by the suspected individual. Further information may be obtained from a combination of sources, including insurance personnel, attorneys, police or forensic accountants.

Conclusion

The investigation of employee dishonesty claims varies from insured to insured because no two businesses operate exactly the same way.  Each business has a structure and record keeping system that is unique to the business and its industry.  The preceding information should serve as a basis for beginning the investigation of an employee dishonesty claim. The initial goal should be to objectively determine whether or not the claim can be sufficiently documented.  If so, your ultimate goal should be to convince a jury in a civil trial by the preponderance of the evidence that the suspected employee is the individual responsible for the claimed misappropriations.

This article was published in the May 2004 issue of The Informant, a bi-monthly publication for members of the Illinois Chapter of the International Association of Investigation Units.