Forensic Audit Case Study: How We Uncovered AED 2M Fraud

[Note: Details have been modified to protect client confidentiality while maintaining educational value]

Case Overview

Company: Mid-sized trading company (AED 180M annual revenue) Industry: Construction materials import/distribution Fraud Type: Procurement fraud and kickback scheme Amount: AED 2.4M over 18 months Perpetrator: Senior Procurement Manager (8-year employee) Detection: Unusual vendor patterns flagged during internal audit Investigation Duration: 6 weeks Recovery: AED 1.8M (75%) through insurance and asset seizure

Initial Red Flags

Our involvement began with a routine internal audit that identified concerning patterns:

Red Flag #1: Vendor Concentration

One vendor ("Al Majd Trading") accounted for 22% of procurement spend (AED 39.6M annually), despite:

• Company policy limiting any vendor to 15% of spend
• Al Majd not appearing in prior years' top 10 vendors
• Al Majd's prices averaging 8-12% higher than comparable suppliers

Red Flag #2: Approval Irregularities

The Procurement Manager (PM) had approved 94% of Al Majd invoices, versus 45% of other vendors:

• Invoices frequently just under PM's approval threshold (AED 49,999)
• Multiple invoices on same dates for similar amounts
• Minimal competitive bidding documentation

Red Flag #3: Payment Patterns

Al Majd received unusually favorable payment terms:

• Average payment: 18 days (vs. company average 45 days)
• Several advance payments against future deliveries
• Multiple "urgent" wire transfers personally requested by PM

Red Flag #4: Documentation Gaps

Al Majd transactions had inconsistent documentation:

• Generic descriptions ("construction supplies", "hardware items")
• Delivery notes without receiver signatures
• Purchase orders created after invoices received
• No quality inspection reports

Internal Auditor Action: These red flags prompted management to engage our forensic audit team to investigate.

Investigation Phase 1: Initial Assessment (Week 1)

Engagement & Scoping

We began with:

• Confidential briefing with management (only CEO and CFO aware)
• Preservation of evidence (email accounts frozen, access logs captured)
• Interview plan development
• Data analytics strategy

Data Collection

We obtained:

• 3 years of procurement data (18,000+ transactions)
• All Al Majd-related documents (947 transactions)
• PM's email archive (38,000+ emails)
• Vendor master file changes audit trail
• Payment approval logs
• Physical delivery documentation

Data Analytics

Our forensic data analysis revealed:

Price Analysis:

• Al Majd's prices 8-15% above market for comparable items
• Some items purchased from Al Majd available cheaper from existing vendors
• Price increases not documented or justified

Pattern Detection:

• Invoice amounts clustered just below approval thresholds
• 67% of Al Majd invoices had round-number amounts (AED 45,000, AED 49,000, etc.)
• Timing patterns: Invoices submitted Mondays, paid Thursdays (bypassing normal Friday review meeting)

Vendor Verification:

• Al Majd registered 14 months before first transaction
• Registered address was virtual office
• Signatory was PM's brother-in-law (discovered through public records)
• No website, minimal online presence, no other significant clients

Red Flags Confirmed: The evidence strongly suggested procurement fraud involving vendor collusion and possible kickbacks.

Investigation Phase 2: Deep Dive (Weeks 2-3)

Document Examination

Detailed review of 947 Al Majd transactions revealed:

Fictitious Deliveries (AED 680K):

• 47 invoices with no corresponding delivery notes
• 18 deliveries signed by PM himself (policy violation)
• 12 deliveries to job sites that didn't exist or were completed before delivery date

Inflated Quantities (AED 420K):

• Invoices showed 1,000 units delivered; delivery notes showed 800 units
• Warehouse records didn't match invoice quantities
• Some items never entered inventory system

Inflated Prices (AED 780K):

• Systematic 10-15% premium over market rates
• Items purchased from Al Majd simultaneously available cheaper from existing vendors
• No documented justification for premium pricing

Email Forensics

Analysis of PM's email revealed:

Deleted Emails Recovered:

• Personal Gmail account used for Al Majd communications (against policy)
• Emails discussing "arrangement" and "usual commission"
• Request to "make invoices look normal"

Suspicious Communications:

• Coordination on invoice timing and amounts
• Instructions to avoid certain reviewers
• Requests to create backdated documentation

Interviews

We conducted confidential interviews with:

Warehouse Staff (3 interviews):

• Confirmed delivery discrepancies
• Reported PM sometimes signed for deliveries he didn't witness
• Stated PM discouraged quantity verification for Al Majd deliveries

Accounts Payable (2 interviews):

• Noted PM's urgency on Al Majd payments
• Confirmed PM occasionally submitted invoices directly, bypassing normal channels
• Reported pressure to process payments quickly

Former Employee (1 interview):

• Left company 10 months prior
• Volunteered information about PM's "side arrangement"
• Noted PM's lifestyle improvements (luxury car, expensive watch)

PM Interview:

• Initial denial
• Confronted with evidence, claimed "normal industry practice"
• Eventually admitted "consulting fees" arrangement
• Refused to provide details without attorney

Investigation Phase 3: Quantification & Verification (Week 4)

Fraud Quantification

We reconstructed each transaction to quantify loss:

Fictitious Deliveries: AED 680,000

• Cross-referenced invoices vs. delivery notes vs. warehouse records
• Identified transactions with no supporting delivery evidence
• Confirmed items never used in business operations

Inflated Quantities: AED 420,000

• Compared invoice quantities to actual delivery quantities
• Calculated excess payment for undelivered goods
• Verified through warehouse inventory reconciliation

Inflated Prices: AED 780,000

• Compared Al Majd prices to market rates and alternative suppliers
• Calculated price premium on 623 transactions
• Conservative estimate (used lowest premium identified)

Direct Payments (Kickbacks) to PM: AED 540,000

• Bank records subpoenaed for Al Majd
• Identified payments to PM's personal account labeled "consulting fees"
• Traced through PM's bank records

Total Quantified Fraud: AED 2,420,000

Corroborating Evidence

We gathered additional proof:

Financial Analysis:

• PM's bank deposits exceeded salary by AED 480K over 18 months
• Cash deposits inconsistent with known income sources
• Luxury purchases inconsistent with declared income

Lifestyle Evidence:

• AED 220K vehicle purchased (cash payment)
• AED 85K watch purchased
• Multiple high-value cash purchases

Investigation Phase 4: Reporting & Action (Weeks 5-6)

Forensic Audit Report

We prepared comprehensive report including:

1. Executive Summary: Fraud type, amount, perpetrator, timeline
2. Detailed Findings: Evidence for each component of fraud
3. Methodology: Investigation procedures and data sources
4. Exhibits: Supporting documentation, analysis, timelines
5. Recommendations: Recovery, controls, legal action

Management Presentation

We presented findings to:

• Board of Directors
• Legal counsel
• Insurance carrier
• External auditors

Immediate Actions Taken

Employee Actions:

• PM immediately suspended
• HR investigation commenced
• Termination for cause (no severance)
• All access revoked

Vendor Actions:

• Al Majd relationship terminated
• All pending invoices suspended
• Vendor master file access restricted

Legal Actions:

• Criminal complaint filed with Dubai Police
• Civil lawsuit for damages
• Asset freeze obtained on PM's accounts
• Insurance claim filed (employee dishonesty coverage)

Recovery Phase

Criminal Proceedings

Dubai Economic Crime unit:

• Arrested PM and Al Majd owner (brother-in-law)
• Seized AED 180K from PM's accounts
• Confiscated vehicle (AED 220K value)
• Ongoing prosecution (fraud, embezzlement, forgery)

Civil Recovery

Civil lawsuit resulted in:

• Judgment against PM and Al Majd (joint liability)
• Asset seizure: Vehicle, watches, property
• Total assets recovered: AED 420,000

Insurance Recovery

Employee dishonesty insurance:

• Claim filed: AED 2.4M
• Deductible: AED 100K
• Coverage limit: AED 2M
• Paid: AED 1.4M (after deductible and co-insurance)

Total Recovery: AED 1,820,000 (75.2% of fraud amount)

Control Weaknesses Identified

Our investigation identified systematic control failures:

1. Inadequate Segregation of Duties

• PM could select vendors, approve purchases, and expedite payments
• No independent verification of deliveries
• Approval thresholds too high for single individual

2. Vendor Master File Controls

• PM had ability to add/modify vendor records
• No secondary approval for new vendors
• No periodic vendor verification

3. Payment Controls

• Urgent payment process bypassed normal reviews
• Limited scrutiny of payments below threshold
• No analysis of vendor payment patterns

4. Procurement Monitoring

• No spend analysis by vendor
• Price benchmarking not performed
• Competitive bidding not enforced

5. Delivery Verification

• PM occasionally signed for deliveries (conflict of interest)
• No independent quality/quantity verification
• Delivery documentation inadequate

Corrective Measures Implemented

Based on our recommendations, client implemented:

Immediate Fixes (Month 1)

• All procurement approvals now require dual sign-off
• Vendor master changes require CFO approval
• Delivery sign-off prohibited for procurement staff
• Urgent payment process eliminated

Short-term Improvements (Months 2-3)

• Vendor spend analysis dashboard (monthly review)
• Price benchmarking for top 100 items
• Competitive bidding mandatory for purchases over AED 25K
• Vendor verification process for all new vendors

Long-term Solutions (Months 4-6)

• Procurement ERP module with workflow controls
• Automated purchase order matching (3-way match)
• Data analytics for fraud detection
• Annual forensic audit of procurement function

Ongoing Monitoring

• Quarterly procurement analytics review
• Annual vendor verification and audit
• Whistleblower hotline promoted
• Fraud awareness training (all staff)

Lessons Learned

For Management

Trust but Verify: Long-tenured employees with good reputations can still commit fraud. Trust alone is insufficient control.

Fraud Triangle Always Applies:

• Pressure: PM had gambling debts (learned during investigation)
• Opportunity: Weak controls provided means
• Rationalization: "Everyone does it", "I'm underpaid"

Small Red Flags Accumulate: Multiple small anomalies (individually explainable) together indicate problems.

For Auditors

Data Analytics is Powerful: Manual review of 18,000 transactions would have taken months. Analytics identified patterns in days.

Document Everything: Our detailed evidence collection enabled successful criminal prosecution and insurance recovery.

Vendor Verification Matters: Simple public records search revealed family relationship that could have prevented fraud entirely.

For Organizations

Controls Aren't Expensive: Many corrective measures cost little but would have prevented this fraud:

• Segregation of duties (organizational change)
• Vendor spend monitoring (basic analytics)
• Delivery verification (process change)

Insurance is Valuable: Employee dishonesty coverage recovered 58% of loss. Review your coverage.

Forensic Expertise Matters: Specialized forensic audit skills (data analytics, interviewing, evidence collection) are critical for effective investigations.

Red Flags: How to Spot Procurement Fraud

Based on this and other cases, watch for:

Vendor Red Flags:

• New vendor immediately receives large orders
• Vendor addresses are PO boxes, virtual offices, or residential
• Vendor has no web presence or minimal online footprint
• No other major clients or references
• Family/personal relationships between vendor and employee

Pricing Red Flags:

• Prices higher than comparable vendors
• No competitive bidding for large purchases
• Price increases not documented
• Unusual payment terms or advance payments

Pattern Red Flags:

• Invoices clustered just below approval thresholds
• Round-number amounts (AED 50,000, not AED 47,283)
• Unusual timing patterns
• Same vendor used repeatedly for diverse items

Behavioral Red Flags:

• Employee defensive about vendor questions
• Employee has lifestyle inconsistent with income
• Employee rarely takes vacation
• Employee insists on handling specific vendors personally

When to Engage Forensic Auditors

Consider forensic audit when:

Definite Concerns:

• Fraud discovered or strongly suspected
• Unexplained financial discrepancies
• Anonymous fraud allegations received
• Litigation requiring financial investigation

Preventive/Proactive:

• High-risk areas review (procurement, cash, inventory)
• Pre-acquisition due diligence
• Post-acquisition integration review
• Periodic fraud risk assessments

Conclusion

This case demonstrates how systematic procurement fraud can be detected, investigated, and resolved through forensic audit expertise. Key takeaways:

1. Data analytics reveals patterns invisible to manual review
2. Proper evidence collection enables recovery and prosecution
3. Most fraud involves control weaknesses, not sophisticated schemes
4. Prevention through good controls is far cheaper than detection and recovery

At Farahat & Co, our forensic audit team includes Certified Fraud Examiners (CFEs) with 30+ years of combined experience investigating financial fraud across UAE industries. We've recovered tens of millions of dirhams for clients through systematic fraud investigations.

Contact us for confidential consultation on fraud concerns or preventive forensic risk assessments.