The first 48 hours: acting on a suspicion without ruining the case
Suspicions of internal fraud arrive in different shapes, but the first days after deciding to act tend to set the ceiling on what can later be established. What to preserve, who to involve, and what can wait.