When to commission a forensic audit — and what to do in the first 48 hours

Most fraud is discovered by accident: a reconciliation that will not tie, a vendor who calls about a payment nobody authorised, an employee who resigns abruptly. What happens in the following two days often decides whether the matter is recoverable.

First, do not confront

The instinct is to call the suspected person in and ask. This is almost always the wrong first move. It gives notice, and notice is what allows records to be altered, devices to be wiped and accomplices to be warned. The conversation can happen — after the evidence is secured.

Secure the evidence

Preserve digital access. Suspend the person's ability to alter systems without announcing why. Take a forensic image of laptops and phones where you are entitled to; do not browse them, because casual access destroys metadata.

Ring-fence the records. Bank statements, vendor masters, approval trails, email archives and system logs for the relevant period should be exported and stored separately, with a note of who exported them and when.

Do not "tidy up". Reversing entries or correcting the ledger before the investigation destroys the pattern that shows how the scheme worked.

Then scope the question

A forensic engagement is only as good as its scope. "Find out what happened" is not a scope; "quantify unauthorised payments to vendors created after March 2024, and identify who approved them" is. A narrow, well-defined first phase can always be widened once the shape of the issue is clear.

What a forensic report needs to do

It has to survive challenge. That means every conclusion traces to a document, every document has a chain of custody, and every quantification can be reproduced by someone else from the same records. Our forensic reports have been used in matters before courts of law and in out-of-court settlements — and in both settings the report's usefulness rests entirely on that discipline.

Afterwards, close the gap

The investigation identifies what happened. The control review identifies why it was possible. Frauds that recur almost always recur through the same opening — a segregation of duties failure, an unmonitored master data change, an approval limit that everyone knew how to work around. Fixing that is the part that pays.