Legal, Regulatory, and Reporting Requirements
Civil versus criminal
Criminal cases require proof beyond a reasonable doubt and are brought by the state; civil cases require a balance of probabilities / preponderance of evidence and seek recovery. The investigator gathers facts and may offer expert opinion - the court decides guilt. Never write "the subject committed fraud" as a legal finding; state findings of fact and let counsel draw legal conclusions.
Elements and statutes
Common-law fraud elements: a false statement of material fact, knowledge of falsity, intent to deceive, justifiable reliance, and damages. Know the reach of key statutes: the US FCPA (bribery of foreign officials plus books-and-records provisions), the UK Bribery Act 2010 (including the failure-to-prevent offence and no facilitation-payments exception), Sarbanes-Oxley (certification, whistleblower protection, document destruction), and applicable local penal and anti-corruption codes. Check data-protection law before searching personal devices or HR records.
Reporting obligations
Distinguish internal reporting (audit committee, board, legal counsel) from external reporting (regulators, suspicious activity/transaction reports, law enforcement, external auditors, insurers). Privilege matters: route sensitive work through counsel where available, and remember privilege can be waived by careless distribution. Preserve documents once litigation is reasonably anticipated - spoliation can be sanctioned.
Traps. Assuming one country's rules apply globally; missing mandatory reporting deadlines; promising confidentiality you cannot keep; treating a resignation as case closure.
Rule of thumb. For every report ask: what must be reported, to whom, by when, and who has privileged oversight of the work?