Integrity by Design: Fraud, Corruption, Audit Rights and Sanctions

Development banks lend on the condition that every dollar can be traced and every decision defended. On a FIDIC contract they finance, integrity is not a value statement: it is a contract term, an audit right and a sanctions risk for every firm in the supply chain. Annual audits find fraud after the money has gone. A PMIS designed for the purpose makes the irregular transaction hard to make and easy to see, while it can still be stopped.

Every capital project carries a fraud risk, and few organisations have the courage to say so out loud. On a project financed by a development bank the subject cannot be avoided: it is written into the bidding documents, the contract and the financing agreement, and the consequences fall not only on individuals but on the borrower, the implementing agency and every firm that touched the transaction.

What the Bank actually asks for

The integrity provisions sit in several places. The World Bank’s Standard Procurement Document for Works places the Bank’s policy on corrupt and fraudulent practices in Part C of the Particular Conditions, alongside the Contract Data in Part A and the Specific Provisions in Part B, and gives the Bank the right to inspect and audit accounts and records. The FIDIC MDB Harmonised Edition, the “Pink Book” still used on many Bank-funded contracts, added Sub-Clause 1.15 on the Bank’s inspection and audit of the Contractor’s accounts and records, and Sub-Clause 15.6 on corrupt or fraudulent practices. Under the 2017 General Conditions, Sub-Clause 15.2 already lists bribery and corrupt inducement among the grounds on which the Employer may terminate for the Contractor’s default.

Read together, these provisions ask a project for five things:

• Clean parties. Firms the Bank has debarred, or that are otherwise ineligible, must not participate as Contractor, Subcontractor or supplier. Under the Pink Book, eligibility extends to goods: equipment, materials and services incorporated in the Works must originate in an eligible source country as defined by the Bank.
• Honest decisions. Approvals, certifications and variations are made by the people authorised to make them, within their limits and without conflicts of interest.
• Inspectable records. The Bank, and auditors it appoints, may inspect and audit the accounts, records and documents relating to the contract. Records must exist, be complete and be retained.
• Cooperation. Contractors and subcontractors cooperate with any Bank investigation, which presupposes that information can be produced quickly and in full.
• Consequences. Where corrupt, fraudulent, collusive, coercive or obstructive practices are found, the Employer may terminate and the Bank may sanction the firms involved.

What makes a Bank-funded project different is the third party. A lender with the power to suspend disbursement, and, under Pink Book Sub-Clause 16.2, thereby to trigger the Contractor’s own right to terminate, will be looking at the evidence.

Why after-the-fact audit is not enough

Most projects meet these obligations with a declaration form at award, an annual audit, and the hope that the email and document archive will hold up if anyone asks. The audit is useful, but it is structurally late. It finds the irregularity after it has been paid, when the evidence has had months to decay and the money is hard to recover. Prevention, meaning a process designed so that the irregular transaction is difficult to make and easy to see, is far more valuable and far cheaper.

There is a second, quieter problem. Many projects believe they are digitalised because they run a document management system, a correspondence platform or a common data environment. Those tools are valuable for what they were designed to do, but they were not designed as a project management information system. They record that a document was uploaded. They do not enforce who may approve a variation of what value, check that a payment application matches the quantities measured, or stop a commitment from being split to stay below an approval threshold. The result is a false sense of control: the appearance of digital governance without its substance. On a Bank-funded project, that gap is exactly where integrity failures hide.

Building integrity into the PMWEB process

PMWEB treats integrity as a property of the process. Five controls do most of the work, and each produces its own evidence.

Eligibility gates on every party. In PMWEB every subcontractor and supplier is a company record before it can hold a commitment. Subcontractor approval under Sub-Clause 5.1 is configured as a workflow with a mandatory step recording the check of the Bank’s list of debarred firms, the beneficial ownership declaration where the project requires it, and the firm’s integrity undertakings, each attached to the company record with the date and the name of the person who performed it. Material approvals carry a country-of-origin field, so the eligible source country requirement is evidenced when the material is approved, not reconstructed at the final account.

Delegation of Authority enforced, not documented. A DoA matrix in a policy manual prevents nothing. A DoA matrix configured in PMWEB Workflow does. Approval levels are set by process, value and project, and the Engineer’s actions that the Particular Conditions reserve for the Employer’s consent, under Sub-Clause 3.2 of the 2017 edition or Sub-Clause 3.1 of the Pink Book, route automatically to the Employer before the Engineer can act. A user cannot approve outside their authority because the system never presents them the step.

Segregation of duties. The person who raises a commitment does not approve it; the person who measures quantities does not certify payment; the person who requests a budget transfer does not authorise it. Role-based security and workflow design make these separations structural. Conflict-of-interest declarations are captured on a custom form for every member of evaluation, certification and approval teams, and a declared conflict removes that user from the relevant workflow.

An audit trail no one can edit. Every PMWEB record carries its full history, with comments, and attachments are versioned in Document Management. This is the record the Bank’s auditors need, produced as a by-product of the work rather than as a separate compliance exercise that someone may be tempted to tidy up.

Retention and the evidence pack. Because the contract, its correspondence, approvals, payments and supporting documents are linked in one system, PMWEB produces an audit-ready evidence pack for any contract on demand. When the Bank exercises its inspection and audit rights, the response is measured in hours, not weeks, and the speed itself signals control.

Mapping the integrity obligations to PMWEB

AI that watches the pattern

The controls above stop the obvious irregularity. The harder cases are patterns: a series of small commitments to the same supplier that together exceed an approval threshold; two progress invoices with the same amount and description in different periods; quantities claimed for an item that run far ahead of planned progress; variations clustered just below a no-objection threshold; approvals concentrated in a single user. Each transaction looks acceptable on its own. Together they deserve a question.

PMWEB 2026, rebuilt on Angular with AI embedded, opens the door to use cases that review the structured data PMWEB already holds and flag such patterns for a human reviewer. A flag is not an accusation. It is a prompt for the integrity officer, the Engineer or the PIU’s internal auditor to look more closely while the transaction is still open. AI can only reason over data that exists in structured form, which is why the discipline described in this series comes first: no data, no AI.

The Integrity & Audit Readiness dashboard

The dashboard below is built in PMWEB’s embedded Power BI reporting for the sample programme P-2100, with values in USD millions.

• No firm is engaged without a check. 63 firms work on the programme: 8 contractors and 55 subcontractors and suppliers. 61 have a dated eligibility check on record; the two pending firms, one on C2104 and one on C2105, cannot be given a commitment until the check is complete.
• Authority is enforced, not trusted. There have been no approvals outside delegated authority since award, because the workflow never offered the step to an unauthorised user. Three segregation-of-duties conflicts were flagged in user role set-up; two are resolved and one is under review.
• The AI pattern watch earns its keep. 23 patterns were flagged for review this year: 15 were cleared, 6 remain open and 2 were confirmed. Quantity spikes against the programme (7) and near-duplicate invoices (5) are the most frequent patterns.
• Two confirmed flags, two problems avoided. One near-duplicate invoice was a genuine duplicate, and a payment of 0.42 was stopped before release. One cluster of variations just below the threshold was referred for Employer approval as a single package.
• One contract is not audit-ready. Seven of eight contract evidence packs are complete. C2105 Ring Road South stands at 86%, the same Pink Book contract where an eligibility check is still pending.
• The Bank’s questions are answered fast. Of 14 audit queries raised this year, 11 are closed, at an average of 2.3 days. Variations and approvals take longest (3.0 days on average), records and retention the shortest (1.5 days).

PMWEB 2026 AI on integrity data

Action is taken only with the user’s approval, and PMWEB AI honours security settings, so integrity data, and especially open investigations, is visible only to the roles permitted to see it.

What the PIU must put in place

• An eligibility gate. No commitment for any firm without a dated check against the Bank’s debarment list and, where required, a beneficial ownership declaration.
• Country of origin at approval. Material and equipment submittals carry the origin and its certificates when they are approved.
• DoA in the workflow, not the manual. Approval levels by value and process, with automatic routing to the Employer for actions the Particular Conditions reserve.
• Structural segregation of duties. Separate initiator, reviewer and approver on every financial process, with conflict-of-interest declarations that exclude conflicted users.
• An evidence pack per contract. Commitment, changes, payments, approvals and documents linked, so a Bank audit request is answered the same day.
• A pattern watch with human review. AI flags routed to a named integrity officer, with every flag cleared, kept open or confirmed as a record.

Over to you: On a Bank-funded project, would you rather defend your controls to an auditor after the payment, or have the system stop the irregular transaction before it is approved?

The series: Article 1, Funding Comes with Conditions; Article 2, From Particular Conditions to Platform; Article 3, The First 90 Days; Article 4, ESHS as Evidence; Article 5, People on Site; Article 6, Integrity by Design; Article 7, Change under Scrutiny; Article 8, Paying through the Loan; Article 9, Reporting to the Bank; Article 10, Closing the Contract, Closing the Loan.