Forensic Audit in PMWEB: Rebuilding the Record to Recover Lost Funds

Money lost to fraud on a capital project is usually written off as a sunk cost. It does not have to be. A forensic audit can identify who was involved and support recovery, but only if the project's records can be assembled into a form that can be analysed, compared and trusted.

Parts 1 to 5 of this series described controls that prevent and detect fraud while a project is running. Many owners, however, face the opposite situation: a completed or troubled project, delivered on paper, spreadsheets and email, where something has clearly gone wrong. This article rewrites my earlier article on forensic audits and shows how PMWEB can be used as the audit team's workbench, even when the project was never managed in it.

Is this article for you?

Read this if your project records sit in Aconex, a DMS, a CDE or shared drives, with the money in the ERP and the analysis in spreadsheets, and an audit would first have to rebuild the transactions from PDFs. If you advise clients on project governance, the adviser's checklist near the end turns this article into diagnostic questions and recommendations. Ministries of finance and sovereign funds will find a funder's lens on this topic near the end.

Forensic audit is the last line of defence, not the first. By the time it starts, the money has been paid and recovery depends on lawyers, time and the willingness of the parties involved. It is also where the cost of silence becomes visible: in most cases, someone had suspected the problem long before the audit, but nobody had the mandate, the data or the courage to raise it. Recovering funds is valuable. Preventing the loss would have been worth far more, and the same PMWEB record that supports a forensic audit is what makes prevention possible on the next project.

Compare the economics. A forensic audit and the legal action that follows it can cost a significant share of the amount eventually recovered, and many losses are never recovered at all. A PMIS that prevents the same losses costs a fraction of the capital it protects and keeps protecting it on every project that follows.

The Forensic Challenge Is a Data Challenge

A forensic audit succeeds or fails on the availability of data in a format that allows analysis. At a minimum the team needs:

Findings often widen the scope to substituted materials and equipment, testing and commissioning inspections, and punch lists. Each of these is easier to examine when it sits in a structured record rather than a scanned file.

Rebuilding the Record in PMWEB

PMWEB's out-of-the-box modules for document management, cost estimate, budget, budget requests, vendor prequalification, bid comparison, commitments, progress invoices, miscellaneous invoices and change orders give the audit team a ready-made structure. The work is to load the evidence into it, in this order.

• Documents

All documents in scope are scanned into searchable files and uploaded to PMWEB document management, in folders and subfolders that organise and secure them, for example project contracts, procurement, cost information, correspondence, memoranda and construction claims by type. Attributes capture additional data on each document. The markup viewer lets auditors highlight and annotate key passages. Because the files are searchable, the team can search their content for key events, and each document can be attached to the PMWEB records it supports.

• Cost estimates

Every estimate revision, including the final approved estimate, is captured in the cost estimate module. Where estimates exist in Excel they are imported; where they exist only on paper they are first converted to a structured Excel file. The team can then compare revisions line by line and see what changed, when, and how each change affected the approved budget.

• Budgets: approved versus realistic

The audit team uses the final approved estimate to build a realistic baseline budget, and captures every budget the project actually used, including the approved baseline, in the budget module. Budgets can be pasted in directly to save time. Comparing the approved baseline with the realistic baseline shows where the budget was overstated and by how much.

• Budget adjustments

Every omission, addition and transfer applied to the baseline is captured as a budget request, with its reason, requester, approver, scope and date. Transfers out of contingency, and transfers made shortly before or after a large commitment or change order, receive particular attention.

• Bidders and bids

The invited bidders for each package are captured in the vendor prequalification module and scored on financial capacity, track record, conflict of interest and other criteria, to establish whether they should have been invited. Their bids are captured in the procurement module against the approved estimate, which immediately exposes unbalanced items and front-loading, as described in Part 3. Technical evaluations are captured where available.

• Contracts, change orders, invoices and payments

Each awarded contract is captured as a commitment with its terms and bill of quantities, pasted from Excel. Approved and disputed change orders are captured with the line items they affect and any time extension. Each interim payment certificate is captured as a progress invoice with percent complete, stored materials, amount approved and amount paid, with dates. All other project expenses, such as site storage, permits and authority fees, are captured as miscellaneous invoices.

One Ledger, Full Traceability

Every transaction captured this way posts automatically to the PMWEB cost ledger. The team could load the ledger directly with the financial figures, but this is not recommended, because the traceability from each figure back to its source record and document is exactly what an investigation needs. From the ledger, the team builds cost worksheet layouts for its analysis, adding PMWEB cost fields and new calculated fields, and saves them to Excel when needed.

Forensic teams increasingly hear that the project was fully digital, so the evidence will be easy to find. In practice, when the project ran on a document platform, an ERP and spreadsheets, the audit faces almost the same task as a paper project. The documents are searchable, but the figures inside them are not data. The ERP ledger shows payments, but not the estimate, the bids, the pending changes or the work in place behind them. The platform's logs show who opened a file, not who approved which amount under which authority.

Worse, the belief that everything was digital may have delayed the audit itself. Management assumed the system would have caught problems, so nobody looked until the losses were too large to ignore. That is the real cost of false assurance: it does not only let fraud through, it postpones its discovery. Rebuilding the record in PMWEB, as described above, converts documents back into transactions so they can be tested.

No excuse to stay on the wrong platform

If a forensic review would have to rebuild your records from PDFs, the same will be true of the next one. Migrating to a PMIS like PMWEB now, starting with new programmes and bringing live projects across in waves, means the next audit tests controls instead of reconstructing transactions.

Analysis and Reporting

With the record rebuilt and trustworthy, the team analyses it with Power BI on the PMWEB database. Variances between approved and realistic baselines, awards against estimates, change orders against contract rates, and payments against approved work identify the transactions that need detailed examination. Scorecards and visuals help communicate findings to the board, investigators and legal advisers.

Because PMWEB holds an unlimited number of projects and programmes, the owner can consolidate the results of several audits on one dashboard. That is where correlations appear: the same individuals or companies across troubled projects, the same period, the same project type, the same approver.

Enterprise Forensic Audit Report — Power BI on the PMWEB database, embedded in PMWEB. Illustrative data; parties anonymised.

In the illustrative report, substructure and MEP budgets were overstated by 15% and 11% against the reconstructed realistic baseline. The correlation table shows one approver and one main contractor appearing together on several projects carrying most of the open red flags and linked change orders, and a design consultant associated with an unusual number of design-error changes. These are the leads an investigation follows, record by record, before any conclusion is drawn.

Where PMWEB 2026 AI Helps

Forensic teams spend much of their time looking for things. Once the record is rebuilt, the PMWEB 2026 AI Assistant lets an auditor find records in plain language, such as every change order on a project approved by a given role in a given year, every budget transfer out of contingency above a threshold, or every invoice from a vendor across all audited projects, and open them directly. With the auditor's approval it can create findings as records linked to the evidence. Because it honours PMWEB security settings, sensitive investigation records remain restricted to the audit team. Part 7 explains how analytics can then scan the whole rebuilt record for patterns the team has not yet thought to look for.

Box Files, Non-PMIS Data and a Rebuilt PMWEB Record

The funder's lens — ministries of finance and sovereign funds

• When a forensic review is needed in a funded entity, the funder's priority is recovery and prevention elsewhere. Rebuilding the record in a PMIS shared across entities serves both.
• Cross-entity correlation, the same contractors, consultants or approvers appearing in troubled projects, is only visible to the party that funds them all.

Adviser's checklist — for consultants recommending project governance

Questions to ask in the diagnostic

• Do audit plans test whether controls are enforced by systems, or only whether policies exist?

Recommendations to put in the governance report

• Shift internal audit from sampling transactions to testing system-enforced controls and red-flag dispositions.
• Where a forensic review is needed, rebuild the record in the PMIS that will run future projects.

Evidence That the Forensic Effort Is Working

• Record coverage. Share of in-scope documents and transactions captured and linked in PMWEB.
• Reconciliation. Rebuilt ledger reconciled to the finance system's payments.
• Findings substantiated. Each finding supported by linked records and documents.
• Recovery pursued. Value of findings referred for recovery, back-charge or legal action.
• Controls adopted. Future projects on the same programme run in PMWEB with the controls from Parts 1 to 5.

Key takeaway

A forensic audit is only as strong as the record it rests on. Rebuilding that record in PMWEB gives the audit team searchable documents, a traceable cost ledger and a portfolio-wide view of who was involved where.

"It was all digital" often means the evidence exists but cannot be tested, and the belief that systems were watching delayed the audit itself.

The same platform then runs the next project under the controls that would have prevented the loss.

Recovery is the last line of defence. The record that supports the audit is the same record that prevents the next loss.

Migrating now means the next audit tests controls instead of rebuilding records.

Next in the series: Part 7 brings the series together: how PMWEB 2026 AI, analytics and machine learning built on structured PMWEB data move fraud detection from periodic review to continuous signals.