Cerebra uncovered fraudulent activities of three senior executives in hidden relationships with a dawn raid

SITUATION  

A multinational energy company (The client) was concerned about the costs of services received from a supplier for a critical project managed by its Turkish subsidiary (The victim company). The costs had exceeded the initially planned budget by several folds. The client requested Cerebra to investigate the reasons for this budget overrun and the suspicions surrounding the general manager, financial affairs manager, and accounting manager of the victim company, as well as the supplier. 

OUR SOLUTION 

Firstly, Cerebra held meetings with the overseas committee of independent board members and executive members of the client to understand the suspicions. Since the suspects were still employed by the victim company, we were initially asked to conduct a preliminary covert evaluation using the available data. We began examining the information and documents provided by the client and initiated corporate intelligence investigations into the suspect executives and the mentioned supplier.  

Our preliminary assessment and intelligence work revealed that suspects at the victim company had jointly established a company in which they were shareholders. They signed a service procurement contract between this company and the victim company, making their company a supplier to the victim company, and the supplier issued fraudulent high-value invoices to the victim company every month.  

Furthermore, we found that the general manager created a clear conflict of interest by signing this contract on behalf of the victim company. Shortly after signing the service contract, the general manager and chief financial officer transferred their shares in the supplier company to the suspicious accounting manager. 

Our corporate intelligence indicated that the general manager was a prominent figure in the industry with a dominant personality. 

We shared the findings from our preliminary assessment with the client. After lengthy deliberations, it was decided to conduct a dawn raid to catch the suspects off guard and secure the evidence.

a) Dawn Raid 

Given the general manager’s long-standing control over the victim company, the potential impact of the early morning operation on the suspects was unpredictable. Therefore, every possible scenario was meticulously planned with the overseas executives and lawyers. 

Cerebra’s primary tasks during this process were to conduct interviews with the suspects immediately after the raid and to securely copy all digital data (system data, mobile phones, computers, and accounting records) from the victim company. We planned the post-raid procedures step-by-step with our forensic experts. 

Early in the morning, accompanied by overseas company executives and lawyers, we entered the victim company. First, Cerebra’s fraud investigators and company lawyers informed the suspects executives about the investigation decision and the intention to image their computers and mobile phones for examination. We then collected the devices from the suspects and handed them over to our forensic team to start imaging the devices promptly. 

Additionally, due to the suspects’ senior positions, our client had particular concerns about the security of accounting and other digital data. Therefore, they requested that all accessible data be backed up. Our forensic team met with the victim company’s IT manager on the first day of the investigation to learn where the data was stored and initiated the backup process for these data concurrently with the imaging of the mobile phones and hard drives. 

We completed the imaging of the hard drives and mobile phones by the evening of the same day. The backup process of other data, totalling over 50 TB, was completed within 1.5 days, successfully securing all critical data of the victim company.

b) Interviews with the Suspects 

In the initial hours of the investigation, Cerebra’s critical support was to plan and conduct the interviews with the suspects. Therefore, we prepared intensively for these interviews in terms of techniques and methods before the raid. 

As mentioned earlier, two shareholders of the suspicious supplier (general manager and CFO) had transferred their shares to the remaining shareholder. This shareholder was still working as the accounting manager at the victim company and was issuing monthly invoices from the supplier to the victim company. Therefore, we decided to conduct the first interview with the accounting manager. 

In this extensive interview, the accounting manager, who was the sole remaining shareholder of the supplier, stated both verbally and in writing that despite the transfer of shares, the profits of the supplier were still shared among the three individuals. This statement revealed that the share transfer was only on paper and that, in fact, the three executives were still the owners of the suspect supplier. 

Following the interview with the accounting manager, we interviewed the CFO and finally the general manager. We succeeded in obtaining written statements from both suspects regarding significant parts of their misconduct. 

OUR IMPACT 

Based on the findings and the written statements obtained during the interviews, our client terminated the employment contracts of the three executives at the victim company.  

These individuals had been with the victim company for about 20 years, entitling them to substantial compensation. However, based on the direct evidence we gathered, their contracts were terminated for just cause due to unethical behaviour. This allowed our client to avoid paying large amount of compensation.