From Red Flags to AI: How PMWEB 2026 and Analytics Detect Fraud Patterns Across the Portfolio

Rules find the fraud you already know how to describe. Machine learning finds the patterns you have not yet thought to look for. Neither works on emails, scanned letters and spreadsheets. Both work on the structured, approved, linked transactions a PMIS like PMWEB captures every day.

This final part rewrites and updates my earlier article asking whether machines can be trained to detect fraudulent transactions on capital construction projects. The answer then was yes, provided the business processes are digitised. Since then, two things have changed. PMWEB 2026 has introduced an AI Assistant inside the platform, and AI tools that read PMWEB data directly have become practical for owners to deploy. This article explains what each layer does today, what it needs, and how to adopt it responsibly.

Is this article for you?

Read this if you are being offered AI features on a document platform or CDE as the answer to fraud detection, or if your PMIS lacks the cost and contract data and ERP integration that fraud models need. If you advise clients on project governance, the adviser's checklist near the end turns this article into diagnostic questions and recommendations. Ministries of finance and sovereign funds will find a funder's lens on this topic near the end.

Why Rules Alone Are Not Enough

The red-flag rules in Parts 1 to 6 are essential. They are transparent, easy to explain and cheap to run. But they have limits. Each rule tests one condition that someone already thought of. Fraudsters adapt to known thresholds, for example by splitting a change just below a DoA limit. And the most revealing patterns often span several processes: a contractor that bids low, raises many RFIs, files frequent claim notices and ends its projects in disputes looks unremarkable in any single log.

There is also a difference in timing. A periodic audit tests a sample, months later. Rules and analytics on PMWEB data test every transaction, every period, while the contract is still live and the payment can still be stopped. That turns detection from a historical exercise into an active control.

Analytics that learn from the data, rather than from a list of rules, can examine every transaction against every other and highlight combinations no rule describes. They need one thing above all: a large volume of clean, structured, trustworthy transactions.

Three Layers of Fraud Detection on PMWEB Data

Layer 2: The PMWEB 2026 AI Assistant

The PMWEB 2026 AI Assistant works inside the platform in four modes. For integrity and audit work, each mode removes friction from the review.

Two design principles matter for integrity work. Actions are taken only with the user's approval, so the assistant never changes a record on its own initiative. And the assistant honours PMWEB security settings, so it can only reveal the projects, modules and fields the user's role allows. An AI that ignored those settings would itself be a fraud risk.

PMWEB's AI roadmap places capabilities such as risk identification in later releases. The approach in this article does not depend on them: owners can start with layers 1 and 2 now and build layer 3 on the same data.

Layer 3: Learning Analytics on PMWEB Data

Machine learning refers to techniques that learn patterns in data without a human analyst specifying them. Two families matter for fraud detection, and both should be used.

Supervised models learn from past outcomes

A supervised model is trained on transactions tagged as fraud or not fraud, and learns the patterns that distinguish them. Its accuracy depends directly on the amount of clean, relevant, tagged training data. This is where the Integrity Red Flag record from Part 1 pays off a second time. Every flag that is investigated and closed with a disposition of confirmed or dismissed becomes a tagged example. Over time, the owner's own review history becomes the training set. Typical algorithms include logistic regression, decision trees, random forests, gradient boosting and neural networks; data scientists choose among them based on the volume of data and the need for explanation.

Unsupervised models find what nobody tagged

Where tagged examples are scarce, as they are in most organisations at the start, unsupervised models surface unusual behaviour on their own. Clustering methods such as k-means group similar contractors, contracts or approvers and show which ones sit far from their group. Anomaly detection highlights transactions unlike any others of their type. Association methods such as the Apriori algorithm find combinations that occur together more often than chance, such as a particular approver, consultant and contractor.

My original article gave an example that remains the best illustration. An unsupervised model notices that one contractor raises unusually large volumes of RFIs and claim notices on every project it has with the owner. Its prequalification submission shows pending claims with other owners. The bid comparison history shows it always bids lowest. Together these suggest a claim-oriented contractor that relies on claims to recover margin. No single rule would have joined those facts; the combined pattern did.

What the models learn from

Every process digitised in PMWEB adds features the models can use. The more processes, projects and years in the database, the better they perform.

Completed projects matter as much as live ones. Capturing the key transactions of finished projects, as Part 6 described for forensic audits, gives the models history to learn from.

AI on a Document Platform Is Not AI on a PMIS

The same false assurance is now appearing with AI. Document platforms and CDEs are adding AI features: summarising documents, drafting correspondence, searching across files, reading scanned forms. These are useful features for a document repository. They are not fraud detection. An AI that reads a change order PDF can summarise what the letter says. It cannot tell whether the rate is the contract rate, whether the approver was within their authority, or whether the same contractor's invoices are approved twice as slowly as everyone else's, because none of that is held as data in the repository.

An AI answer that sounds confident but rests on unstructured documents is the most persuasive form of false assurance yet. The safeguard is the same as for every other tool in this series: put the transactions in a PMIS first, then apply AI to data that can be tested.

Reading PMWEB and the ERP Together

Some fraud only shows when project data and finance data are compared: a payment in the ERP with no approved certificate in PMWEB, a vendor bank detail changed shortly before a large payment, or an invoice paid twice through different channels. askAIRO, a CMCS offering for PMWEB clients, is an AI assistant built on the Model Context Protocol (MCP) that answers questions from PMWEB and the client's ERP together. It works with PMWEB hosted on- premises or in the cloud and with the large language model of the client's choice, including one the client hosts on its own servers, which keeps sensitive investigation data inside the organisation.

No excuse to stay on the wrong platform

If your project information sits on a platform that cannot hold transactions as data, no AI added to it will detect fraud reliably. Migrating to a PMIS like PMWEB is the prerequisite for AI-assisted fraud detection, not an alternative to it.

From Scores to Decisions

A risk score is useful only if a reviewer can see why it was given and what to do next. The AI signal review below shows how this looks in practice.

AI Fraud Signal Review — anomaly scores calculated on PMWEB transaction data and presented as a Power BI report embedded in

Using AI for Fraud Detection Responsibly

• A score is a question, not an accusation. Signals start reviews; investigations and due process decide outcomes.
• Explainability is mandatory. Every score must show the features and records that drove it, or it cannot be acted on fairly.
• Humans decide, and their decisions are recorded. Dispositions are captured on the red-flag record and become training data.
• Security follows PMWEB. AI tools see only what the user's role allows; investigation records are restricted.
• Data stays governed. Choose deployment and model options that keep sensitive data within the organisation's control.
• Measure the model. Track precision (share of signals confirmed), coverage and time to review, and retrain on a schedule.

A Practical Adoption Path

The Business Case, Restated

Part 1 showed that when fraud risk is priced in, a PMIS repays its cost many times over: avoiding even a quarter of one percent of leakage on a large capital portfolio is worth more each year than the system costs to own. AI raises that return further, because the same data that enforces controls now also finds the patterns that rules miss, and every reviewed signal makes the next one more accurate. The investment that prevents fraud is the same investment that makes AI possible.

The funder's lens — ministries of finance and sovereign funds

• Ministries and funds that see many entities hold the largest potential data set for fraud analytics, provided those entities capture transactions in a consistent, structured way.
• Requiring a common PMIS standard across funded entities is what makes portfolio-wide AI signals possible.

Adviser's checklist — for consultants recommending project governance

Questions to ask in the diagnostic

• Is the client being offered AI on a document platform as a fraud-detection answer?
• Does the client hold enough structured, approved transaction history for analytics to learn from?
• Are red-flag dispositions recorded so they can become training data?

Recommendations to put in the governance report

• Sequence AI after structured capture: digitise, flag, assist, learn, connect.
• Require explainable reason codes and human disposition for every AI signal.
• Keep sensitive investigation data within the client's control when selecting AI deployment options.

Key takeaway

AI does not replace fraud controls. It depends on them. Every template, workflow, link and disposition captured in PMWEB is a data point that makes detection more accurate.

AI on a document repository summarises what was written; AI on PMWEB tests what was approved.

Owners who digitise their processes in PMWEB today get control now, AI-assisted review with PMWEB 2026, and the data foundation for learning analytics as their transaction history grows.

Migration to a PMIS is the prerequisite for AI fraud detection, not an alternative to it.

Series complete: Parts 1 to 7 are available on LinkedIn and on the CMCS website. Owners who want to start can begin with the high-risk processes in Parts 2 to 5 on a new programme, and extend from there.