Corporate fraud rarely begins with a dramatic discovery. More often, it emerges through a small inconsistency: an unfamiliar payee, a payment that does not correspond with its stated purpose, an employee account receiving organisational funds, a missing voucher, or a bank trail that refuses to reconcile with the explanation appearing in the ledger.
What follows is frequently treated as an accounting exercise. Management asks Finance to explain the discrepancy, Internal Audit reviews several transactions, and Legal is brought in only when the explanations cease to make sense.
That sequence is understandable, but dangerous.
A serious corporate fraud investigation in Pakistan is not simply an attempt to discover where money went. It is a multi-layered legal process requiring the organisation to preserve evidence, distinguish fact from inference, protect the fairness of disciplinary proceedings, identify the proper criminal and civil remedies, and confront the governance weaknesses that allowed the conduct to continue.
The quality of the organisation’s response matters almost as much as the alleged misconduct itself. A poorly managed investigation can compromise electronic evidence, expose witnesses, waive legal privilege, create employment claims, invite accusations of bias and ultimately reduce a complex financial case to a few incoherent lines in a police record.
The deeper lesson is uncomfortable but necessary: discovering wrongdoing is not the same as proving it, and proving it internally is not the same as translating it into an effective criminal, recovery or governance case.
The Investigation Must Begin Before the Accusation
The first mistake organisations make is to accuse before they preserve.
Once a suspected employee becomes aware that an investigation is under way, records may disappear, devices may be reset, WhatsApp conversations may be deleted, witnesses may be contacted, explanations may be coordinated and documents may be retrospectively “regularised”.
The proper first response is therefore containment rather than confrontation.
Access to financial systems, banking portals, cloud storage, official email, accounting software, cheque books and sensitive records should be reviewed immediately. Relevant devices, communications, account statements, vouchers, ledgers, transaction approvals, audit files and bank correspondence should be preserved in their existing form.
This should be done under written authority, preferably through a Board or senior governance resolution identifying the scope of the preservation measures and the persons authorised to implement them.
Electronic evidence must be handled with particular care. Pakistan’s Electronic Transactions Ordinance, 2002 recognises electronic documents, records, information and communications, while Article 164 of the Qanun-e-Shahadat Order, 1984 permits courts to receive evidence made available through modern devices or techniques. The existence of those provisions does not mean that every screenshot will automatically be accepted as reliable evidence; authenticity, completeness, attribution and preservation remain crucial.
A screenshot of a WhatsApp message may be useful, but the original device, complete conversation, date and time metadata, telephone number, surrounding messages and export history may prove far more important. Likewise, an Excel reconciliation prepared after discovery is valuable as an analytical tool, but it does not replace the original bank statement, cheque image, payment instruction or accounting entry.
Evidence should therefore be preserved in two forms: the original material and a working investigation copy. The latter may be annotated, indexed and analysed. The former should remain untouched wherever practicable.
Define the Scope Before the Inquiry Expands Without Limit
Corporate investigations often begin with one category of transactions and rapidly expand into unrelated grievances, historical suspicions and personality conflicts.
That expansion can weaken rather than strengthen the process.
If the initial concern relates to employee-benefit funds, the investigation report should not automatically incorporate separate allegations concerning cash withdrawals, procurement, tax payments, vendor relationships or operational expenditure unless those matters have been investigated to the same evidential standard.
A prudent organisation may maintain parallel workstreams. One may concern a completed category of transactions suitable for disciplinary determination. Another may concern newly discovered operational payments requiring further bank records and witness interviews.
Separating them prevents an otherwise strong investigation from being challenged on the ground that management reached final conclusions about matters that were still being examined.
The investigation mandate should identify the relevant period, accounts, transaction categories, employees, documents and decision-making standard. It should also state expressly what is excluded.
Clarity of scope is an act of fairness. It protects the organisation from mission creep and protects the employee from being required to answer an ever-changing allegation.
An Internal Finding Is Not a Criminal Conviction
A corporate investigation performs a different function from a criminal trial.
An internal disciplinary committee ordinarily determines whether misconduct is established on the balance of probabilities: whether it is more likely than not that the relevant conduct occurred. Criminal guilt remains for the investigating authorities and courts, applying the criminal standard and procedural safeguards.
The internal report should therefore avoid declaring that an employee is “guilty” of a criminal offence. It may properly find deliberate deception, gross misconduct, breach of trust, misuse of authority, conflict of interest, failure to account and destruction of the confidence necessary for continued employment.
This distinction is not timidity. It is precision.
An organisation does not need to postpone every disciplinary decision until the police complete an investigation that may take years. Nor should it use an internal inquiry to pronounce criminal guilt without the protections of a criminal trial.
The proper question for the Board is whether the employee has been given fair notice, a genuine opportunity to respond, access to the substance of the allegations and a reasonable opportunity to identify any documents required for the defence.
A controlled inquiry does not necessarily require unrestricted restoration of the employee’s access to the very systems and records being preserved. Specific documents may be provided or made available without returning administrative control of the organisation’s financial infrastructure to the person under investigation.
The Difference Between Missing Documents and Affirmative Fraud Evidence
A weak investigation concludes that the employee failed to produce paperwork.
A strong investigation asks whether independent evidence contradicts the employee’s explanation.
Consider a composite hypothetical. Finance personnel are told that certain confidential payments are required to address an urgent institutional or government-related issue. Employee account holders are separately told that the same money represents personal funds or family-property proceeds that cannot be transferred directly. The employees receive organisational money and then transfer matching or near-matching amounts to accounts nominated by the senior officer.
That is no longer merely a documentation failure.
It is evidence of inconsistent narratives, controlled information and possible pass-through-account routing.
The most persuasive corporate fraud cases are often built through triangulation:
- The accounting record shows the organisational source.
- The bank statement identifies the first recipient.
- The WhatsApp conversation shows who supplied the onward account.
- The recipient explains what he or she was told.
- The onward bank transfer identifies the ultimate or intermediate destination.
- The employee under investigation provides a materially different explanation.
- No single item needs to carry the entire case. The strength lies in the convergence of independent sources.
The “Information Bottleneck” Model of Corporate Fraud
Many organisations take comfort in dual signatures, annual audits and division of responsibilities. Those controls are valuable, but they may be illusory where one individual controls the information supplied to every participant.
A senior finance officer may control the cheque book, supporting proforma, ledger entry, beneficiary narrative, first signature, bank liaison and audit explanation. The second signatory sees only the cheque and a summary sheet. The recipient sees only an inward transfer and is given a personal explanation. The auditor sees only the file selected for review.
Formal segregation exists, but knowledge remains concentrated.
This is the information-bottleneck model of corporate fraud.
It explains how several people may participate in different stages of a transaction without any one of them, apart from the controlling person, seeing the complete chain.
It also explains why “two people signed the cheque” is not a complete defence.
A second signature proves participation in the authorisation process. It does not automatically prove knowledge of the false purpose, personal benefit or onward destination. Equally, a signatory cannot always escape responsibility by saying that Finance prepared the documents.
The proper inquiry is transaction-specific:
What was the signatory told?
What documents were shown?
Was the payee recognisable as a lawful beneficiary?
Was the amount unusual?
Were questions asked?
Was direct verification discouraged?
Did the signatory receive any benefit?
Did the person continue signing after concerns arose?
The possible conclusions range from deception of the signatory to negligence, gross negligence, wilful blindness or knowing participation. Justice requires differentiation rather than collective accusation.
The Internal Report Should Not Be One Document for Every Audience
A recurring governance error is to prepare one enormous investigation report and circulate it indiscriminately to the Board, donors, auditors, banks, employees, police and external advisers.
Each audience has a different legitimate need.
The comprehensive investigation record should contain the evidence schedule, witness material, transaction matrices, bank records, legal issues, contradictions, unresolved questions and litigation considerations. Access should be limited to the Investigation Committee, Board and legal advisers according to role.
The Board report should be shorter. It should explain the process, principal findings, financial exposure, governance implications, unresolved co-signatory issues and decisions requiring approval.
The donor or stakeholder summary should be shorter still. It should explain the incident at an appropriate level, the action taken, recovery progress, Board oversight and improvements to internal controls. It should exclude privileged legal advice, raw witness recordings, unnecessary personal banking information, litigation strategy and unverified accusations against persons whose roles remain under review.
This layered approach is consistent with the underlying purpose of corporate governance. The SECP describes effective governance as a means of protecting shareholders and other stakeholders from managerial misconduct, fraud and potential civil or criminal liability, and notes that governance principles remain relevant to private, public, non-profit and government organisations.
Transparency is not the indiscriminate disclosure of every document. It is the disciplined disclosure of accurate information to the persons entitled to receive it.
Translating the Internal Investigation into a Criminal Complaint
One of the most dangerous points in a corporate fraud matter arises after the Board has approved criminal escalation.
The organisation may have spent weeks preparing transaction matrices, preserving communications, interviewing recipients and reconstructing the movement of money. Yet the entire matter may then be reduced to a vague police application or an illegible FIR referring to one generic offence.
An FIR is not a final prosecution brief. Section 154 of the Code of Criminal Procedure, 1898 governs the recording of information relating to a cognisable offence, while the police investigation and resulting report proceed under the wider criminal-procedure framework, including section 173.
Nevertheless, the foundational complaint should communicate the essential architecture of the alleged offence:
the position of trust or entrustment;
the accused person’s authority and control;
the property or money involved;
the period and approximate exposure;
the alleged unauthorised conversion, diversion or routing;
the principal recipient or intermediary categories;
the contradictory explanations;
the available bank and communication evidence; and
the records requiring immediate preservation or production.
A complaint that merely says that an employee “misappropriated money” may technically initiate a process, but it does not assist the investigating officer in understanding the mechanism, identifying evidence or tracing proceeds.
The police complaint should be accompanied by a controlled annexure set: a concise chronology, transaction summary, account-flow schedule, relevant bank documents, recipient statements, key communications and Board authority. The complete privileged legal file should not be handed over without a deliberate disclosure decision.
Selecting Penal Provisions: Neither Minimalism nor Decoration
The Pakistan Penal Code distinguishes between the definition and punishment of criminal breach of trust and specific forms of the offence arising from the accused person’s capacity. Sections 405 and 406 address criminal breach of trust generally, while sections 408 and 409 concern particular relationships and positions, including clerks, servants, agents and other specified persons. Depending upon the proved facts, cheating, forgery, use of forged documents or falsification of accounts may engage sections 420, 468, 471 or 477-A.
Those provisions should not be inserted mechanically.
Section numbers are not substitutes for facts. A complaint that indiscriminately cites every conceivable offence may appear inflated and may obscure the actual theory of the case.
Equally, reducing a complex employee or fiduciary diversion case to a single generic provision may fail to reflect the accused person’s entrusted capacity, false representations, altered records or accounting manipulation.
The better method is an offence matrix. For each proposed provision, counsel should identify the legal ingredients, the supporting facts, the evidence presently available and the evidence still requiring police collection.
The purpose is not to secure the most dramatic FIR. It is to build the most sustainable case.
The Original Complaint Matters as Much as the FIR
When the registered police narrative appears inadequate, management should not immediately assume that external counsel failed.
The police may compress a detailed complaint into a brief FIR. Conversely, counsel may have filed a vague application and later represented to the client that a comprehensive criminal case had been initiated.
The only reliable method is to compare the records.
The organisation should retain:
the signed complaint prepared by counsel;
the police receiving or diary acknowledgement;
the annexures submitted;
the registered FIR or formal police record;
the name and designation of the investigating officer;
and counsel’s written filing plan.
That comparison shows whether the evidential architecture was lost at the drafting stage or at the police-registration stage.
It also allows management to file a supplementary statement, correct figures, supply omitted evidence and request examination of additional offences disclosed during investigation.
A registered FIR is the beginning of criminal investigation, not proof that the legal work has been completed.
Recovery Must Not Become an Afterthought
Corporate fraud litigation often becomes excessively focused on arrest and criminal punishment. The emotional appeal is understandable, but the organisation’s practical objective must include recovery.
The Board should consider parallel measures: a formal accounting demand, civil recovery proceedings, trust or fiduciary claims, injunctions, preservation of identifiable assets, bank tracing, claims against direct or indirect recipients and lawful set-off against amounts otherwise payable.
Criminal proceedings and civil recovery serve different purposes. A police case does not automatically return the money. An arrest does not establish the location of proceeds. A conviction, even if ultimately secured, may arrive years after the assets have disappeared.
Recovery planning should therefore begin during the internal investigation, not after the FIR.
The transaction matrix should distinguish between total questioned exposure, amounts affirmatively traced, amounts received by intermediaries, amounts transferred onwards, amounts retained and amounts still requiring KYC or clearing confirmation.
Double counting must be avoided. If money passed from the organisation to an employee account and then to the accused, those are two stages of the same amount, not two separate losses.
The Organisation Must Investigate Itself Too
The easiest response to corporate fraud is to identify one dishonest employee and declare the problem solved.
That response may be institutionally comforting and morally incomplete.
If one person could control supporting records, first signatures, beneficiary descriptions, bank communications and audit liaison over several years, the organisation must ask why its governance permitted that concentration.
If trustees had no direct access to trust records, why were they trustees?
If signatories did not receive beneficiary documents, what did their signatures actually verify?
If repeated payments entered employee or related-party accounts, why did no exception report identify the pattern?
If a person remained on a bank mandate after leaving employment, who was responsible for reconstitution?
If auditors received incomplete information, how was the audit file selected and controlled?
Corporate governance is not merely a shield against individual dishonesty. It is a system designed to ensure that dishonesty cannot easily survive the ordinary operation of controls.
SECP’s governance materials emphasise that poor governance creates conditions conducive to fraud and harms stakeholders, while governance principles for non-listed organisations are available as a framework for improving accountability and risk management.
What Effective Remediation Looks Like
A credible remediation plan should be measurable rather than ceremonial.
Replacing one signatory with another is not reform if the new signatory still receives only a cheque and a verbal assurance.
Effective remediation may include direct trustee access to records, minuted trustee meetings, mandatory beneficiary verification, independent confirmation of related-party status, pre-signature document checklists, secure cheque custody, callback verification for unusual payments, monthly exception analytics and prompt reconstitution of signatories after resignation or conflict.
The organisation should test for repeated payees, round-number payments, split transfers, employee pass-through accounts, unexplained payments to non-beneficiaries and transactions just below internal approval thresholds.
Whistleblower and non-retaliation measures should also be formalised. A witness who fears retaliation, exposure or collective blame may remain silent until losses become substantial.
The Board should receive periodic implementation reports identifying the action, responsible person, deadline, evidence of completion and unresolved risk.
“Policy updated” is not evidence that the control works.
Fairness Is Not Weakness
Corporate fraud produces understandable anger. Employees may feel betrayed; trustees may fear exposure; donors may demand immediate action; management may want the accused removed before the evidence is fully organised.
Yet fairness remains indispensable.
The accused employee should know the substance of the allegations and have an opportunity to answer them. Co-signatories should not be declared accomplices merely because their signatures appear. Witnesses should not be promised immunity unless the organisation has consciously and lawfully decided to do so. Allegations of forgery or document alteration should be tied to identifiable records rather than repeated as institutional folklore.
Fairness strengthens the eventual decision because it deprives the wrongdoer of avoidable procedural objections.
It also expresses a deeper principle. The purpose of an investigation is not to manufacture certainty. It is to approach truth through disciplined doubt.
Conclusion: The Real Test Begins After Discovery
A sound corporate fraud investigation in Pakistan does more than identify missing money or an allegedly dishonest employee.
It preserves the original evidence. It reconstructs the movement of funds. It separates established facts from inferences. It provides the accused with procedural fairness. It differentiates the controlling actor from those who may have been deceived, negligent or complicit. It translates internal findings into a coherent police complaint. It pursues recovery in parallel. It informs the Board and stakeholders without sacrificing privilege or witness protection. And, perhaps most importantly, it compels the institution to examine its own failures.
The worst corporate investigations replace one form of concealment with another. The alleged wrongdoer concealed the transaction; the organisation then conceals the governance failure.
The better path is more demanding. It requires accountability without recklessness, transparency without indiscriminate exposure, and reform without convenient scapegoating.
Justice in a corporate investigation does not consist merely in finding someone to blame. It consists in proving what occurred, protecting those entitled to fairness, recovering what can be recovered and ensuring that the same institutional weakness cannot quietly reproduce the same harm.
This article is a general legal and governance discussion based upon recurring issues observed in Pakistani corporate investigations. It does not describe any particular client, organisation, employee or pending matter and should not be treated as legal advice for a specific case.