What forensic work is for
Businesses call us at one of two moments. Either something has been found — an invoice that does not match anything delivered, a supplier nobody recognises, a stock count that is short by more than shrinkage explains. Or something feels wrong: margins that have drifted without a reason, a manager unusually protective of a process, a pattern of small write-offs.
The purpose of the work is not to satisfy suspicion. It is to establish what actually happened, quantify it, and produce evidence in a form that survives challenge — because the decisions that follow, whether employment, insurance or legal, all depend on the quality of that evidence rather than on the strength of the belief.
Who we do this for
Businesses that have identified a specific irregularity. Businesses with unexplained losses where ordinary explanations have been exhausted. Businesses acting on a whistleblower report. Businesses whose insurer or lawyer has asked for quantification of a loss. And partners or shareholders in dispute, where one side’s conduct of the business is in question.
Also, occasionally, businesses that want an investigation to clear someone. That is a legitimate use of the work and it is more common than people assume.
What we actually do
The sequence matters here, so we run it the same way each time:
- Secure and preserve first. System access, email, accounting data, physical documents. This comes before analysis and before any conversation with anyone involved.
- Scope with you and, where appropriate, with your lawyer, so the work supports whatever action may follow rather than having to be redone.
- Establish the baseline. What the records say happened, before testing whether it did.
- Analyse for patterns — duplicate payments, suppliers sharing bank details or addresses with employees, round-sum invoices, payments just under approval thresholds, transactions timed to periods when review was absent.
- Trace the flows. Follow specific transactions from origin to bank and, where possible, beyond.
- Verify physically where stock or assets are involved.
- Interview, when the evidence is assembled and not before, and in a sequence that does not alert the subject prematurely.
- Quantify the loss on a defensible basis, distinguishing what is proven from what is inferred.
- Report in a form that supports employment, insurance or legal action, with the evidence referenced rather than described.
The patterns we look for first
Most internal fraud in owner-managed businesses is not sophisticated. It exploits a gap in oversight and repeats until noticed:
- Ghost or related suppliers — a vendor sharing a bank account, address or phone number with an employee
- Duplicate payments — the same invoice paid twice, with one payment redirected
- Threshold avoidance — a cluster of transactions just below the level requiring a second approval
- Payroll manipulation — a leaver still on the payroll, or an employee who does not exist
- Stock leakage — write-offs, damage and returns used to conceal removal
- Credit note abuse — sales reversed after cash collection
- Expense inflation — individually small, cumulatively material, and usually the easiest to prove
The data analysis that surfaces these is not exotic. It is systematic comparison of fields that should not match and do — and the reason it works is that these patterns are only invisible when nobody looks for them.
Evidence, and what makes it hold
The difference between an investigation that supports a decision and one that does not is almost entirely procedural.
Data has to be preserved before it is analysed, with the chain of custody documented. Findings have to distinguish what is proven from what is inferred, because conflating the two undermines the whole report. Quantification has to rest on a basis that can be explained and tested, not on an estimate that sounds reasonable. And the report has to be written knowing it may be read by a lawyer acting for the other side.
We work with your legal advisers from the start where proceedings are a realistic possibility, because sequencing decisions taken in the first week determine what is available in the sixth.
The failures we are called in to fix
What we see most often:
- Confronting someone before securing the evidence. The most common and most costly error in these matters.
- Letting the person concerned retain system access during the investigation.
- Analysing copies of data with no record of how they were obtained, which weakens everything built on them.
- Investigating internally through the same finance team the concern relates to.
- Quantifying loss on assumption rather than on evidence, and losing credibility on the whole report.
- Delaying, because records are deleted, staff leave, and recollection fades.
- Treating it as an accounting exercise when it may become a legal one.
Timing and deadlines
Immediately on suspicion, and in the right order: preserve, then analyse, then interview. Every week of delay costs evidence, and the deletion of a mailbox or the departure of an employee can remove a line of enquiry entirely.
Where a legal or insurance route is possible, involve your lawyer or insurer at the outset rather than after the investigation. Insurers frequently have notification requirements with their own deadlines, and a claim can be prejudiced by a delay that had nothing to do with the underlying loss.
What you get
- Evidence preserved with a documented chain of custody
- A written report of findings, separating what is proven from what is inferred
- Loss quantified on a defensible basis
- Supporting evidence indexed and referenced
- Control recommendations to prevent recurrence
- Support for employment, insurance or legal proceedings where required
What to have ready
What we ask for up front:
- A description of the concern and how it arose
- Accounting system access, including audit trail and user logs
- Bank statements for the relevant period
- Supplier and employee master data
- Relevant contracts, approvals and correspondence
- Details of who has access to what, including system permissions
- Any internal enquiries already made — and what was said to whom
How this is priced
Scoped in phases, because the extent of an investigation genuinely cannot be known at the outset. The first phase — preservation, initial analysis and an assessment of whether there is something to investigate — is fixed fee.
After that phase you get a written view of what we have found, what further work would involve and what it would cost, and you decide whether to continue. Some investigations end there, either because nothing was found or because what was found is enough to act on.
Related
Frequently Asked Questions
We suspect an employee. What should we do first?
Preserve evidence and secure system access before speaking to anyone. Confronting someone early is the most common way an investigation is compromised — records get deleted and documents disappear. Call us before the conversation, not after it.
Will an external audit find fraud?
It is not designed to. An audit samples for material misstatement in the financial statements; most internal fraud is individually below that threshold and specifically structured to avoid attention. A clean audit opinion is not evidence that nothing is happening.
How long does a forensic investigation take?
It depends entirely on scope, which is why we work in phases. The first phase — preservation, initial analysis, and an assessment of whether there is something to investigate — is fixed fee and gives you a decision point before committing further.
Can the report be used in legal proceedings?
It is written with that possibility in mind: chain of custody documented, proven findings separated from inferred ones, and quantification on a basis that can be tested. Where proceedings are realistic we work with your lawyers from the outset, because early sequencing decisions determine what is available later.
What if we find nothing?
That is a legitimate and not uncommon outcome, and it is worth having. Sometimes an investigation clears someone, which matters both for them and for the working relationship. We report what we find, including when what we find is nothing.
Should we tell our insurer?
Usually yes, and early. Insurers frequently have notification requirements with their own deadlines, and a claim can be prejudiced by a delay that had nothing to do with the loss itself. That is a conversation to have at the start rather than after the investigation.
How do these frauds usually work?
Rarely with any sophistication. Ghost suppliers sharing bank details with an employee, duplicate payments with one redirected, transactions clustered just below an approval threshold, a leaver still on payroll, or write-offs concealing stock removal. They are invisible only because nobody is looking for them.
Call before you speak to anyone involved. Preserving access and data first is the single decision that most affects what the investigation can establish.
Check my compliance status 058 101 9570
Last reviewed 27 July 2026. Rates, thresholds and deadlines change — the e-invoicing provider deadline has already moved once. Confirm current requirements with the Federal Tax Authority before acting, or ask us to check your position.