Twenty years ago, a fraud examiner pulled a sample of invoices, checked them against purchase orders, and hoped the fraud happened to fall inside the sample. That method still shows up in textbooks, and it misses most schemes. A payroll clerk who adds one ghost employee, or a manager who splits purchases to stay under an approval limit, leaves a small mark on a very large dataset. Sampling walks right past it.
Data analytics changed the math. Instead of testing a sample, an examiner can now run the same checks against the entire population of transactions, from the first payment of the year to the last. When you look at all of it, the patterns a fraudster relies on to stay hidden become the thing that gives them away.
What the software actually does
The core work is matching and comparison. Vendor bank accounts get checked against employee bank accounts to surface a payment routed to an insider. Charges get sorted to reveal a run of amounts that all land just below a signing threshold. Duplicate payments fall out of a simple query. So do invoices with sequential numbers from one vendor, and refunds issued after business hours.
Benford's law is a favorite because it is cheap and it works. In genuine accounting data, the leading digits of numbers follow a predictable curve. More figures start with 1 than with 9. When someone fabricates amounts, they tend to invent numbers that do not follow that curve, and a chart of the digits shows the bump.
Larger cases add link analysis. Software maps the relationships between people, companies, and accounts, then draws the connections a spreadsheet would hide. A shell company that shares an address with an employee's spouse is obvious on a chart and nearly invisible in a list of 4,000 vendors.
The software narrows a million records down to a few hundred worth a human's attention. Reading those few hundred is the job.
Digital evidence and the paper trail
Most of the record now lives on devices. Email, chat logs, accounting exports, and the metadata on files often tell the story the ledger only hints at. Forensic tools index this material so an examiner can search years of messages for the phrase that matters, and they preserve it in a way that holds up if the case reaches a courtroom. How the data was collected, and whether it was altered, are questions a defense lawyer will ask. The handling matters as much as the finding.
Timeline reconstruction ties it together. When a suspicious payment went out, who approved it, what got said in email that week, and when records were deleted can all be placed on a single line. A gap in that timeline is often as telling as an entry.
The tool is not the examiner
Analytics produce a list of exceptions rather than a conclusion. A flagged transaction might be fraud. It might also be a coding error, a legitimate rush order, or a quirk in how one department books its costs. Someone has to know the business well enough to tell the difference and to decide which threads are worth pulling.
That judgment is where a case is won or lost. The software cuts a million records down to a few hundred worth a person's time. Deciding what those few hundred mean, and building an account of what happened that a judge or an insurer will accept, is the part that does not automate.
Seeing red flags like these in your own numbers?
A confidential consultation costs nothing and tells you where you stand.
What it means for your matter
Most engagements are not Enron. But the pattern is the same at every scale: a diverted vendor payment, a related party that shouldn't exist, revenue booked before it was earned, a reserve fund that never quite reconciles. The methods used to expose a multibillion-dollar fraud are the same methods that expose a bookkeeper skimming from a small business or a managing agent taking kickbacks from a co-op.
If something in your financial picture doesn't add up, the earlier a forensic accountant looks, the more of the trail survives. Documents get lost, memories fade, and money moves. The record is easiest to reconstruct while it is still fresh.
Think something's wrong with your numbers?
Talk to a forensic accountant. It's confidential, and there's no obligation.