Forensic accounting and interim measures · Madrid and Alicante
An employee defrauds their company. Before dismissing them, secure the evidence and freeze their assets. Forensic accounting examination and interim measures.
In brief. The natural reaction on discovering an embezzlement is to confront the employee, dismiss them and change the locks. It is the worst possible order: the moment they know they have been found out, the evidence disappears, the money disappears and sometimes so do they. The correct order is the reverse: first secure the evidence, then secure the money, and only then act against the person.
The business owner’s natural reaction on discovering an embezzlement is to call the employee in, confront them, dismiss them and change the locks. It is understandable, and it is the worst possible order. As soon as the employee knows they have been discovered, three things happen: the evidence disappears (e-mails deleted, the laptop formatted, the mailbox emptied), the money disappears (moved to other accounts or withdrawn) and sometimes the person disappears, occasionally from the country. The correct order is the reverse: first the evidence is secured, then the money, and only then is action taken against the person.
Internal fraud is rarely detected by controls. It is discovered through a sick leave that forces someone else to do the defrauder’s job, a mismatch that can no longer be covered, a supplier claiming an invoice the company believed paid, or an anonymous tip from a colleague. And when it is discovered, it has been running for years: trust, lack of rotation and the absence of segregation of duties allow a small deviation to repeat itself hundreds of times. The first task is not to accuse: it is to quantify, with a forensic accounting examination that reconstructs the full circuit, not a manager’s estimate.
| Step | Action | Why | Typical error |
|---|---|---|---|
| 1 | Forensic preservation of devices and mail | Evidence disappears the moment the employee knows | Confronting the employee first |
| 2 | Forensic accounting quantification | The final amount is almost never the visible one | Denouncing on a manager’s estimate |
| 3 | Locating the defrauder’s assets | Without assets located there is nothing to freeze | Waiting for the judgment to look for assets |
| 4 | Complaint with interim measures | The freeze is requested from the first filing | A bare complaint that recovers nothing |
| 5 | Coordinated dismissal | Criminal and employment must tell the same story | A dismissal letter contradicting the expert report |
| 6 | Negotiation where appropriate | Acknowledgement of debt with real guarantees | Accepting promises without security |
| 7 | Trial and enforcement | Conviction and civil recovery | Arriving at sentence with an empty estate |
| 8 | Prevention | Segregation of duties and rotation | Restoring the same controls that failed |
This sequence is indicative; the correct strategy depends on the evidence available, the amounts and the specific circumstances of each case.
Almost all the evidence lives in the employee’s computer, e-mail and ERP, and almost every case is lost there. The company may access the means it has made available to the worker, but it needs a prior usage policy warning of the possibility of monitoring, and access must be proportionate and limited to what is strictly necessary. Ransacking the employee’s personal mail, or folders marked private, renders the evidence unlawful, and annulled evidence drags down everything derived from it. Entire proceedings have collapsed over a hasty extraction. The correct route is forensic preservation with chain of custody, carried out by an expert, before the equipment is touched. We work with forensic accounting and digital evidence under a single legal direction, coordinating the criminal route with the employment route.
Companies that discover internal fraud: preservation, quantification, freezing of assets and private prosecution.
Directors answering to the board for the fraud and its handling: diligence documented at every step.
Employees accused of internal fraud: challenge of the digital evidence, of the quantification and of the classification.
Fidelity and crime insurers: independent quantification and subrogation in the recovery.
Speak to a criminal lawyer
Criminal defence in English before the courts of Alicante and the rest of Spain, for residents and for visitors who have flown home.
Société de Conseil Juridique et Expert es un despacho de abogados con sedes en Madrid, Alicante, Londres y París, especializado en defensa y acusación penal, delitos económicos y corporativos y derecho tecnológico. Trabajamos con orientación estratégica en procedimientos penales complejos, propiedad intelectual y análisis forense avanzado, y prestamos consultoría jurídica, compliance y escudos de protección a particulares y empresas. Atendemos desde Alicante y Madrid, con consulta online en toda España y asistencia al detenido 24 horas. Resuelva sus dudas en las preguntas frecuentes o solicite una primera consulta.
Copyright © 2026 Société de Conseil Juridique et Expert S.L.
