The First 72 Hours After an Allegation Decide Most of What Follows

An allegation lands: an anonymous email to the chair, a vendor complaint, an auditor's query, an analytics exception that will not go away. The natural instinct is to find out quickly whether it is true, which usually means asking someone. That instinct causes more damage than almost anything else in the life of a fraud matter.

The first 72 hours are not for answering the allegation. They are for taking the decisions that will let you answer it properly, and for avoiding the mistakes that cannot be undone.

Hours 0–24: ownership and silence

Decide who owns it

The matter needs an owner who is independent of the people and functions involved and has authority to commission work. If the allegation touches the managing director, CFO, a director or a promoter, the owner is the audit committee, usually through its chair. Otherwise, a small group drawn from legal, compliance and internal audit, excluding the line management concerned.

Record the decision, and who is in the circle. Every additional person who knows increases the chance of a leak.

Bring in counsel early

Engaging external counsel at the outset helps structure the work and puts the company in the best position to argue that legal advice and work done in contemplation of litigation are protected. Whether privilege attaches is a question of specific legal advice; the point is to ask it on day one, not after the report is written.

Do not confront

Resist the urge to "just ask" the person concerned. A confrontation before evidence is secured gives them time to delete messages, move money and coordinate with others. If immediate harm must be stopped, do it through access and payment controls rather than a conversation.

Hours 24–48: preserve and protect

Preserve evidence quietly

Identify the likely sources: email accounts, laptops and phones issued by the company, shared drives, ERP and banking system logs, messaging platforms used for work, CCTV and access records. Then:

• issue a confidential preservation instruction to IT, suspending routine deletion for the relevant accounts;
• arrange forensic imaging of devices and collection of mailboxes, with hash values and a documented chain of custody;
• extract relevant system data with a record of who extracted what, when and how;
• do not let IT, managers or the complainant browse the subject's mailbox or device.

Electronic records relied on in court will need a certificate under s. 63 of the Bharatiya Sakshya Adhiniyam 2023. Collection done properly now makes that straightforward later. Our guide to preserving digital evidence in internal investigations explains the steps.

Stop the bleeding, discreetly

Depending on the allegation:

• hold payments to the vendors or distributors in question, using an ordinary-looking reason;
• restrict system privileges, especially the ability to change master data or approve payments;
• alert banks if funds may still be recoverable, for example after a payment diversion;
• change shared credentials the subject holds.

Mind the data rules

Under the DPDP Act 2023, s. 7(i) treats processing of personal data for employment purposes, or to protect the employer from loss or liability, as a legitimate use. Keep collection proportionate to the allegation and record why each source was chosen. Most data fiduciary obligations under the DPDP Rules 2025 take effect around 13 May 2027, but the principles are worth applying now.

Hours 48–72: map the obligations and the plan

Who may need to be told

Work through the list deliberately and record each decision:

• Insurers: crime and fidelity policies often require notice within a fixed period of discovery.
• Statutory auditor: the auditor has its own duty under s. 143(12) of the Companies Act 2013 if it has reason to believe that officers or employees are committing fraud. Plan who will brief it and when.
• Stock exchanges: for listed entities, fraud by the company, its promoters, directors or key managerial personnel and the initiation of a forensic audit can be deemed-material events under SEBI LODR.
• Lenders and regulators: check covenants and any sector-specific reporting duties.
• Police: a criminal complaint may be appropriate, but it hands control of timing and evidence to the authorities. Decide deliberately, with counsel.

Scope the investigation

Write down the allegation, the questions to be answered, the period, the people and the sources of evidence. Decide who will investigate. Matters involving senior people, complex accounting or heavy digital evidence usually need independent investigators.

Plan for people

Decide what happens if the subject resigns, goes on leave or asks for their data. See our view on employee exits during an investigation.

Common mistakes

• The corridor conversation. A manager asks the subject "is there something I should know?" and the evidence is gone by evening.
• IT as investigator. Well-meaning browsing alters metadata and can undermine admissibility.
• Too many people told. Every extra person increases leak risk and the chance of witnesses comparing notes.
• Missing notice deadlines. Late notification to insurers can cost the claim.
• Scoping by the accused's manager. The person who chose, supervised or championed the subject should not shape the investigation.

Where we can help

We support companies from the first call: setting up ownership and protocol, forensic preservation of devices and data, scoping and running the investigation, and starting asset tracing early where money has left. Speak to us in confidence.