Introduction
‘How should we respond if fraud occurs within the organisation?’
In recent years, there has been a sharp rise in incidents such as breach of trust by directors and the leakage of trade secrets. According to statistics from the National Police Agency, the number of breach of trust cases recorded in 2024 reached 100, double the figure from five years ago. Improper accounting practices at listed companies have also been on the rise for four consecutive years.
Whilst many companies are implementing preventative measures, such as compliance training and strengthening their audit departments, these have their limitations. This is where ‘fraud investigations’ become crucial. These are not merely a matter of ‘surveillance’; they are a vital initiative for enhancing transparency across the entire organisation.
In this article, we provide a detailed explanation of investigative techniques based on real-life cases of fraud detection. We outline the differences between the two approaches—‘digital forensics’ and ‘human intelligence’—as well as their respective advantages and disadvantages, and key considerations for choosing between them. We have put our heart and soul into producing this article in the hope that it will provide readers with a ‘new perspective on risk management within organisations’.
The two main methods of fraud investigation – ‘digital forensics’ and ‘human intelligence’ – uncover the truth
There are two main methods used in corporate fraud investigations: ‘digital forensics’ and ‘human intelligence’. Whilst both share the same objective, their approaches differ significantly. Understanding the characteristics of each is key to conducting an effective investigation.
What is digital forensics?
Digital forensics is a method of preserving and analysing data from work computers, smartphones and other devices to uncover information relating to fraud or criminal incidents. It is common practice to engage specialist firms for this purpose, and it is also possible to install software on a computer to preserve data remotely.
The advantage of this method is that it allows for the collection of ‘objective evidence’. Information saved in written form—such as email correspondence with business partners or documents simulating remuneration calculations—can be utilised in legal proceedings at a later date.
What is HUMINT (Human Intelligence)?
HUMINT refers to ‘information-gathering activities conducted through human-to-human contact’. It is a method of uncovering the truth by interviewing not only the subject of the investigation but also relevant individuals in their immediate circle. In certain companies, this is carried out by ‘having an investigation firm interview relevant individuals in the subject’s immediate circle’.
The strength of HUMINT lies in ‘its ability to take emotional contexts into account’. It enables the collection of undocumented information—such as interpersonal relationships, motives, or behind-the-scenes facts—that cannot be ascertained from documentary evidence alone.
Key points for distinguishing between the two approaches
In practice, it is often difficult to investigate everything using digital forensics alone. Consequently, there is a growing trend towards combining this with HUMINT for reasons of cost-effectiveness. It is said that where the objective is simply to ‘gather enough evidence to force someone to resign’, HUMINT can be a more cost-effective option.
On the other hand, where it is necessary to file a criminal complaint or pursue legal action, objective evidence is essential. It is realistic to gather evidence through digital forensics and then decide on a course of action, such as ‘voluntary resignation’ or ‘filing a lawsuit’.
A comprehensive guide to the specific procedures, advantages and disadvantages of each method
In this section, we will provide a detailed explanation of the practical aspects of each research method. We will outline the actual procedures involved in conducting the research and explain the advantages and disadvantages of each method.
Specific procedures for digital forensics
The typical process for conducting digital forensics is as follows:
① Identifying the devices to be investigated
Firstly, you must determine which devices (such as computers and servers) are to be investigated. In many companies, this is limited to ‘company-issued devices used for business purposes’.
② Implementation of data preservation
Methods include commissioning specialist firms to preserve data remotely, or collecting devices under the pretext of ‘replacing them because the lease agreement has expired’. With recent technology, it is also possible to analyze a user’s daily usage patterns without their consent.
③ Identifying suspicious data
We extract data that serves as evidence, such as email records indicating collusion with business partners and documents relating to the calculation of remuneration. There have been actual cases where ‘evidence of fraud was gathered one piece after another’.
How to Put HUMINT into Practice: Advantages and Disadvantages
Human intelligence is an effective means of supplementing areas not fully covered by digital forensics:
① Interviewing people close to the subject
We gather information from people in the subject’s immediate circle (colleagues, contacts at business partners, etc.). We ask questions tactfully so as not to arouse the suspicion of the person implicated in the alleged misconduct.
② Behavioral observation
Where necessary, this may involve investigators directly monitoring the subject’s movements. There is also a method whereby investigators monitor the movements of executives and staff.
③ Cost-effectiveness
As the volume of supporting documentation increases, costs may rise significantly. Since the objective can be achieved once the required level of evidence has been met, HUMINT may offer a cost advantage in some cases.
Summary and Comparison of the Various Methods
| Item | Digital Forensics | HUMINT |
| Main objective | Gathering objective evidence | Understanding Relationships and Motivation |
| Advantages | Advantageous in legal proceedings | Cost-effective |
| Disadvantages | Limited to the scope of server administration | Privacy considerations are necessary |
| Cost | Prices soar as data volumes increase | Relatively low-cost |
| Scope of Application | Business terminals and servers only | Wide-ranging information gathering is possible |
Points to Note and Additional Information — Privacy Risks and the Limitations of the Survey —
Whilst digital forensics and HUMINT are powerful investigative techniques, there are several important points to bear in mind. Understanding these will help to maintain trust across the organisation.
Respect for privacy is essential
Even with work devices, it is necessary to respect employees’ privacy. The basic scope of digital forensics is ‘limited to servers and cloud services managed by the company’. In some cases—such as where confidential company documents are photographed using a personal smartphone and leaked externally—it can be difficult to ascertain the full facts through digital forensics alone.
For this reason, from a privacy perspective, the employee’s consent is required in order to ask them to hand over their personal device; the reality is that ‘it is highly unlikely that someone who has committed misconduct would willingly comply’.
Limitations of the Scope of Investigation
Digital forensic investigations are generally limited to ‘company-issued work devices’ and ‘company-managed servers and cloud services’. The strength of HUMINT lies in its ability to overcome this limitation. By utilising its characteristic of ‘information gathering through human contact’, it is also possible to uncover information stored in paper documents or on personal devices.
Limitations of the Scope of Investigation
Digital forensic investigations are generally limited to ‘company-issued work devices’ and ‘company-managed servers and cloud services’. The strength of HUMINT lies in its ability to overcome this limitation. By utilizing its characteristic of ‘information gathering through human contact’, it is also possible to uncover information stored in paper documents or on personal devices.
- Approval of Voluntary Resignation (Holding the Individual Accountable Whilst Avoiding Criminal
- Decision on whether to pursue legal action (confirmation of the existence of objective evidence)
- Review of internal measures (strengthening preventive measures whilst recognizing our limitations)
- The background to the rise in fraud observed across the industry as a whole
The reason this investigative approach is becoming increasingly important is the rise in fraud across the industry as a whole:
- According to the National Police Agency, the number of cases of breach of trust recorded by police forces across the country in 2024 totalled 100, double the figure from five years ago.
- The number of trade secret infringement cases detected due to the leakage of confidential information reached a record high of 38 in 25.
- Disclosures of accounting irregularities by listed companies totalled 67 cases in the 24th financial year, marking the fourth consecutive year of increase
It is also important to bear in mind that, ‘according to the National Police Agency, evidence is required to uncover misconduct such as breach of trust’. By understanding how to distinguish between digital forensics and human intelligence, an organization can respond appropriately and swiftly.
Summary
‘What should you do if fraud occurs within an organization?’
The answer is clear. By using the two approaches—‘digital forensics’ and ‘HUMINT’—appropriately, you can address the issue efficiently and effectively. However, it is important not to view this merely as ‘surveillance’. It must be positioned as a key initiative aimed at ensuring transparency across the entire organisation.
We must recognise the premise that ‘even if we put systems in place to prevent fraud, we cannot completely eliminate the risk’. With this in mind, it is important for senior management and staff in the risk management department to understand ‘which approach is most effective in achieving the objective’. Doing so will enable them to investigate allegations of internal fraud calmly and objectively.
The key point is to view this not merely as ‘evidence gathering’, but as ‘an initiative to enhance transparency across the entire organization’. Whilst there is a technical term known as ‘digital forensics’, this essentially involves the ‘continuous, covert monitoring and analysis of the usage of work computers’. On the other hand, ‘HUMINT’ consists of ‘information-gathering activities conducted through human contact’.
The notion that ‘HUMINT’ can overcome the limitations of digital forensics—which is restricted not only to company-issued work devices but also to company-managed servers and cloud services—is of paramount importance in modern risk management. It is essential to understand the fundamental principle that ‘whenever allegations of misconduct arise, an investigation into the facts is required first’.
Although technical terms such as ‘digital forensics’ and ‘HUMINT’ may seem somewhat complex, their essence boils down to the simple principle of ‘accurately ascertaining the facts and addressing them across the entire organisation’. It is worth bearing in mind the message that ‘preventive measures alone are insufficient to prevent cases of misconduct; proper investigation and a calm response are crucial’.
