Forensic Accounting & Fraud Investigation in Thailand

Common fraud patterns inside a Thai company

Employee embezzlement usually starts with a small gap nobody double-checks: a purchasing officer who sets up a shell vendor to receive purchase orders, an accounting clerk who moves funds into a personal account and books it under a vague expense line, or a cashier who lets petty cash run high without regular reconciliation. What these patterns share is that the person doing it is usually highly trusted and rarely takes extended leave, precisely because a stand-in taking over the desk risks noticing what does not add up.

Fake vendors and kickback schemes tend to be more layered because two parties are involved. A purchasing staffer colluding with an outside supplier may inflate prices above market and pocket the difference as an off-book commission, or approve invoices for goods and services that were never actually delivered. What makes these hard to catch is that every document looks correct on its face — signatures present, tax invoices formatted properly — while what is missing is evidence that the goods were received or the service was actually used.

Inventory shrinkage and revenue skimming are particular hazards for cash-heavy or physical-goods businesses — restaurants, retail shops, and service businesses that collect payment over the counter. A person who controls both cash receipt and the recording of it can quietly drop selected sales out of the till before the daily close, so reported revenue understates reality consistently, and nobody notices until it is checked against actual cost of goods consumed.

Scoping the engagement so evidence holds up in court and in labour proceedings

Before a single document gets pulled, the objective needs to be settled, because the evidentiary bar for a criminal embezzlement or fraud charge differs from the bar for dismissing an employee without severance under labour law. A criminal case must establish intent and the elements of the offence beyond reasonable doubt, while dismissal for misconduct rests on the lighter standard of reasonable grounds to believe wrongdoing occurred. The same evidence set should therefore be built to support both tracks from the outset, rather than gathered for one and patched together for the other later.

Chain of custody is the piece most organisations overlook when they have never run an internal investigation before. Once a suspect document surfaces — a fake invoice, an altered ledger page — someone needs to record who found it, where, when, and how it was kept afterwards, with a copy of the original made before any further analysis. Without that record, opposing counsel in court or before a labour tribunal can credibly argue the document may have been tampered with along the way.

The scope should also name who has authority to expand the investigation on the fly if new anomalies surface, because the first finding is often only a slice of a larger pattern. Without a fast approval mechanism, the investigation team ends up pausing at every new lead to seek sign-off, burning time and risking that the suspect becomes aware and destroys what evidence remains. Naming a decision-maker in advance is a scoping detail that gets skipped far too often.

Interview and documentation discipline during the investigation

Interviews with non-suspect witnesses should always come first, to map how the normal process actually works and where it deviates from what it should be. Starting with peripheral witnesses also reduces the risk of the suspect learning early that they are the focus. At least two interviewers should be in the room at all times — one asking, one taking notes — so there is a second person able to confirm what was said if a statement is later disputed as having been distorted.

By the time a suspect is interviewed, the documentary evidence confirming the facts should already be in hand rather than starting with an open-ended request for the suspect to explain everything themselves, which only invites a plausible cover story. An effective interview usually opens with general questions about duties and routine steps, then walks through documents one at a time, asking the suspect to account for each discrepancy as it appears. Answers should be recorded as close to verbatim as possible, with the interviewee asked to sign off on the record before the session closes.

Throughout the investigation, the team must keep confirmed fact strictly separate from inference or personal opinion; a report that blends the two is an easy target for a claim of jumping to conclusions in court. Keeping the investigation team's own running log matters just as much, because it shows the timeline of when each piece of evidence surfaced and what was decided at each step — an essential reference when the whole process later has to be explained to counsel or to a police investigator.

Digital records, bank statement analysis and reconstructing missing books

Almost every modern accounting transaction leaves a digital trace — access logs to the accounting system, approval emails, or edit histories on document files. Analysing these requires imaging the full data set before touching the original machine, so nobody can later argue the data changed during the review. Unusual access timestamps, such as logins outside working hours or from a device never used before, are often the best starting point for tying a timeline to the questionable transactions.

Reviewing a suspect's personal bank account is only possible with consent or an order from a competent authority; a company has no standing to demand a personal statement on its own. What is workable is a detailed review of the company's own accounts, watching for transfers to accounts that do not match the registered vendor name, or payments deliberately split into smaller amounts to stay under a two-tier approval threshold. That splitting pattern is a much stronger sign of deliberate evasion than coincidence.

Where books or supporting documents have been lost or destroyed, reconstruction has to draw on multiple indirect sources together: bank statements, tax invoices held by the counterparty, warehouse in-and-out logs, and returns already filed with government agencies, which the company itself cannot go back and alter. Cross-checking across several independent sources this way gives the reconstructed figures far more weight than relying on staff recollection or a single account of events.

Quantifying loss for a criminal complaint and a civil claim

The loss figure used in a criminal complaint to police needs to be provable and conservative, because setting the number higher than the evidence can actually support risks undermining the credibility of the entire complaint once it cannot be fully substantiated. A safer approach is to layer the loss: a first tier consisting of amounts directly confirmed by documents beyond dispute, and a second tier built on estimation from a recurring behavioural pattern, with the calculation method and assumptions used clearly separated from the first tier.

In a civil claim to recover the loss, the scope of the claim can run wider than the criminal case, since it can include default interest, actual investigation costs incurred, and in some situations consequential business loss — a lost customer, say, because goods delivered under a vendor-collusion scheme did not match what was agreed. These consequential losses, though, need a clearly demonstrated causal link back to the fraud, not a general assertion about overall business impact.

Running the criminal and civil tracks in parallel means watching closely for inconsistent wording across the two document sets, since the other side can use the criminal complaint against the civil claim if the figures or facts asserted do not line up. The safer practice is to have the same team, or teams coordinating closely, prepare both, reviewing the numbers for consistency every time before either is filed.

When the suspect is also a director or shareholder

A suspect who also holds a director title complicates matters, because that person may have signing authority over key documents and system access no ordinary employee has. The investigation should stay as quiet as possible until enough evidence has been gathered, since a director who becomes aware early can use their own authority to delete data or move documents out of the system with little effort. The remaining board should consider temporarily restricting that director's system access through a properly minuted resolution grounded in stated reasons, not a bare accusation.

Where the suspect is also a shareholder, disciplinary or legal action needs to keep those roles distinct — dealing with the person as a manager who breached duty is a different matter from their standing as a shareholder with statutory rights, some of which persist even under a fraud allegation. Restricting a shareholder's rights beyond what the law permits can turn into a fresh dispute that pulls attention away from the underlying fraud finding.

Removing a suspect director should always run through the process the company's articles and shareholder resolutions actually require, not just a board majority where the articles specify something else. Rushing removal by skipping the prescribed steps invites the removed director to challenge the resolution's validity, delaying the entire process and giving the accused party an opening to attack procedure instead of answering the underlying fraud allegation.

Insurance and fidelity-bond claims for the loss suffered

Fidelity-bond and employee dishonesty policies usually run their notice clock from the date the company discovered or should have discovered the loss, not from the date the fraud actually occurred. Waiting to notify the insurer until the internal investigation is fully wrapped up risks a denial on the grounds of late notice. The safer approach is to give preliminary notice as soon as suspicion is well-founded, then follow with fuller detail and evidence as the investigation progresses.

The documents insurers typically request include the full internal investigation report, accounting evidence quantifying the loss, and proof the company acted promptly to stop further loss once discovered — cutting off the suspect's system access, for instance. Producing a properly documented report from the outset directly affects how quickly a claim moves, since insurers routinely resist loss figures that arrive without a clear derivation or supporting paper trail.

Where no fidelity coverage is in place, recovery options narrow to pursuing the wrongdoer directly, which is often limited by that individual's actual ability to pay. Looking into what assets or security might be seized from the suspect during proceedings should therefore run alongside the litigation itself, so a final judgment does not end up as a number on paper with nothing left to enforce against.

Fixing controls after the fraud episode closes

The most direct fix once fraud has surfaced is separating duties that had been sitting with one person — cash receipt, ledger entry, and expense approval need to sit with different people, firmly. Most of the fraud patterns above happened precisely because a single individual controlled more than one step of the same cycle. Splitting that control does not necessarily mean hiring more staff; in many cases it just means a two-tier approval step using people already on the payroll.

Unannounced spot checks should become a permanent routine rather than a temporary reaction, since staff who know a review runs on a fixed schedule can prepare cover for it in advance. Surprise inventory counts, random sampling of new vendor invoices, and direct confirmation calls to vendors are low-cost measures with strong deterrent value, particularly once every employee knows these checks genuinely happen and happen regularly.

Finally, onboarding for new vendors and new employees deserves a tighter review — checking the registered address and juristic-person number of every new vendor before they are added to the system, and confirming that vendor bank details or addresses do not overlap with any staff member's personal information. None of this eliminates fraud entirely, but it materially lowers the chance the same pattern repeats unnoticed until it is too late again.

When to act, and when waiting is fine

• Suspicion has just begun with nothing concrete yet

  Do not confront the suspected employee first; secure the documents and complete peripheral-witness interviews before anything else

• Both dismissal and a criminal case are being pursued together

  Scope the evidence to the higher criminal standard from the outset, since evidence adequate for a criminal case is usually adequate for dismissal too

• The suspect is a director or holds high-level system access

  Move as quietly as possible until sufficient evidence is in hand, and restrict system access only through a properly reasoned resolution

• A fidelity or employee-dishonesty policy is already in place

  Give preliminary notice to the insurer as soon as suspicion is well-founded, rather than waiting for the internal investigation to fully conclude