Full reasoning chain
Every conclusion carries its reasoning and a citation to the source document, with agent actions and human overrides recorded in sequence.
Solution · Corporate Fraud
The cases that arrive without an alert.
Corporate fraud investigation software for allegations with no upstream alert. A hotline report. An audit exception. A manager who has noticed something. Nothing has been scored, no population has been narrowed, and the evidence is a ledger, a folder of invoices and eighteen months of email. The first hard question is where the investigation stops.
ScopeEvidenceFinding
The work
What the file
actually takes.
The allegation is narrow — one person, one vendor, one period. The population that has to be tested to prove or disprove it is not. And unlike an alert, nothing upstream has done any of the narrowing for you.
01
Referral and scope
The allegation, the subject, the approvers, the period, the entities, the systems in scope — and the mechanism alleged, which drives everything after it.
02
Preservation
Legal hold applied, sources identified, and the population collected and indexed with the collection itself recorded.
03
Reconstruction
Transactions, approvals, documents and communications assembled into a single chronology for each allegation.
04
Testing
The allegation and the innocent explanation tested against the same evidence, and each control failure mapped to where it should have caught it.
05
Findings
The determination, the evidence behind each finding, the interview file, and the actions your policy mandates.
Where the agents run
Plan. Examine. Report.
The same three agents run this case type as run every other. What differs is the policy behind them — the plan template, the dimensions scored, the tools available, and the report that comes out.
One chronology, not four systems.
A misappropriation finding is almost never one document. It is an invoice, the approval that let it through, the payment that followed, and the message where two people discussed it — sitting in four systems, in four formats, with no shared key between them. RiskPulse assembles them into one dated chronology per allegation, with the underlying document attached at every line. That assembly is the fortnight of an investigator's work that produces no insight until the moment it is finished.
- One timeline per allegation — ledger, document, approval and communication evidence in date order, not four exports to reconcile by hand
- The document, not a reference to it — every line carries the invoice, approval record or message it came from
- Both explanations tested — what must be true if the allegation holds, and what must be true if it does not
- Control failure mapped — where the process should have caught it, and why it did not
RiskPulse · Case record
The interview, prepared against the evidence.
An interview conducted before the chronology is built is a fishing expedition, and it warns the subject. RiskPulse assembles the file first, then drafts the questions the evidence actually raises — including the ones that test the innocent explanation, and the ones that test what the subject has already said on record. Your investigator conducts it, judges the answers, and decides what follows.
- Questions from the evidence — each one tied to the document, approval or message that raises it
- The innocent account tested too — questions that would clear the subject if the answers hold
- Prior statements surfaced — what has already been said on record, so a denial can be tested against it
- Documents to hand — the exhibit for each question attached, in the order the questions run
RiskPulse · Interview file
Policy for this case type
Configured,
not hardcoded.
Nothing on this page is fixed in the product. Every element below is a policy setting you define, which is why the same platform runs this case type and the others.
- Domain
- Corporate and internal investigations — with its own matter types: misappropriation, expense abuse, payroll fraud, asset misuse, conflict of interest and undisclosed related parties.
- Risk dimensions
- Subject, control, concealment, collusion and exposure risk — the weights, the composite bands and the override rules are yours. Concealment is the dimension that separates error from intent.
- Plan template
- The mechanism alleged drives the scope, the systems reached, the population collected and the tests that must run against it.
- Report template
- Your investigation report format, including the findings ranking, the control failures section, and the actions your policy mandates.
Controls
Defensible
after the fact.
The same governance and quality controls apply to this case type as to every other — because an examiner does not lower the standard for the harder files.
Quality control
Sampling built in
A sampling methodology sits behind this case type, so your quality team can assess a representative sample rather than reviewing at random.
Quality assurance
Independent assessment
A separate set of agents assesses case quality end to end against your methodology — a second opinion on the work.
See it on your own file
Bring a real case.
We’ll show you the workflow.
Pick a closed investigation and see how RiskPulse scopes it, builds the chronology, and writes it up under your policy.
Request Demo