Proper employee conduct policies are important in facilitating the investigation of alleged incidents of fraud. It pays to plan ahead. Thinking it can't happen to you will only make investigation and recovery more difficult when it does.

Some recommendations for inclusion in published employee conduct policies:

• Specifically forbid inappropriate behavior and provide examples, including unacceptable use of computer systems.
• Provide specific consequences for inappropriate behavior
• Explicitly state that all electronic data as well as all other records and company property are subject to access, audit, and review by authorized individuals at any time.
• State that all computers, peripherals, and communications networks (whether owned, rented, or leased) are company property and should only be used for legitimate company business.
• Management has the legal right to view all employee e-mails, Internet logs, login/logout, and other electronic records.
• Management, auditors, fraud examiners and others appropriately authorized have the right to investigate any alleged inappropriate acts.
• The organization maintains the right to search the employee's work area and seize all materials pursuant to an investigation of criminal activity or non-compliance with any company policy.

Source: Bigler, Mark. (2000, July/August) Computer forensics procedures and tools for fraud examiners. The White Paper. pp. 11, 13-14.