The hardest part of a fraud investigation is rarely the analysis. It is the moment between noticing something off and committing to escalate. A run of expense claims sitting just under the approval threshold. A vendor whose payment cadence shifted three months after a procurement manager moved roles. An access log that does not quite line up with the work pattern. You have seen enough to be uneasy. You have not yet seen enough to write a memo.
Thomson Reuters’ 2025 Generative AI in Professional Services report found that around 53% of compliance teams are now piloting or actively using generative AI for tasks like regulatory horizon scanning, policy summarisation, and audit prep. The use case the report does not flag, but that compliance professionals talk about privately, is the one in this post: closing the gap between an instinct and a defensible investigation file.
The framework, in four stages
Compliance pros who use AI well on fraud work do not point a chatbot at their data and ask “is this fraud.” They run a structured sequence: typology, evidence list, control test, escalation memo. Each stage has a single decision attached to it, and AI is used to remove the structuring overhead at each one, not to make the call.
Stage 1: Match the pattern to a typology before you do anything else
The first move when something feels off is not to start pulling records. It is to name what you suspect, in the technical language a regulator or external counsel would use. If you cannot name the typology, you cannot run a clean evidence search.
This prompt, dropped into Claude or ChatGPT, gives you a short list of named typologies to test against:
“I am a compliance and risk manager at a [SECTOR, e.g. mid-sized regional bank / general insurer / asset manager / large retailer with centralised AP]. I am observing the following pattern: [DESCRIBE THE PATTERN IN SPECIFIC, NEUTRAL LANGUAGE, e.g. ‘six expense reports from one cost centre, all between 95 and 99 percent of the $2,500 approval threshold, submitted in the final 72 hours of each of the last six monthly cycles, by three different employees who report to the same manager’]. List the four most likely fraud or financial-crime typologies this is consistent with. For each typology, give the technical name regulators would use, the common motive, and the two or three secondary signals I should expect to see if this typology is genuinely present. Do not tell me whether fraud has occurred.”
The output is a typology shortlist you can defend in writing. The failure mode at this stage is asking AI for a verdict instead of a frame. If you ask “is this fraud,” you will get a confident-sounding answer and no investigation file. Ask for typologies and secondary signals only.
Stage 2: Build the evidence request before you escalate
Once you have a typology shortlist, the next decision is what additional data you need before this becomes a formal investigation. This is the stage where most internal cases stall, because writing a clean evidence request from a blank page is slow.
“For each of the typologies you identified, list the specific records, system logs, and documentation I should pull to either confirm or rule it out. Group the requests by source system (HR, ERP, expense platform, email, building access). For each request, note the minimum time window I should ask for and any defensible reason a manager could give for refusing. Output as a numbered checklist I can attach to an internal evidence request.”
You now have a checklist that someone outside compliance can action. Pair it with a case-management platform like LogicGate Risk Cloud or AuditBoard so the request, the response, and the time stamps live in one place rather than in your inbox. The counterintuitive insight here: the value of the AI-generated checklist is not that it finds clever evidence sources you would have missed. It is that it removes the 30 to 45 minutes of staring at a blank document, which is exactly the friction that lets soft cases die.
Stage 3: Stress-test your own controls against the same pattern
Before you escalate, run the pattern back through your own control environment. The question you are answering is not “did fraud happen” but “if it had happened, would we have caught it.” Regulators ask this question. Boards ask it. You should ask it first.
“You are a senior internal auditor red-teaming our fraud controls. Given the typology shortlist above and our control environment ([LIST 4 to 6 KEY CONTROLS, e.g. dual-approval thresholds, vendor master file change reviews, monthly variance analytics, segregation of duties, quarterly access recertification]), tell me which controls should have triggered on this pattern, which would have been bypassed, and where the genuine blind spot is. For each blind spot, suggest one low-cost compensating control we could add within 30 days.”
This step turns a single case into a structural improvement, and produces audit-ready documentation as a byproduct of the work you were doing anyway.
Stage 4: Draft the escalation memo your future self will thank you for
The final stage is converting everything above into a memo that someone other than you can read and act on. This is where AI saves the most time and where the failure mode is sharpest.
“Draft an internal escalation memo for the Head of Compliance summarising the following: the observed pattern (neutral language, no conclusions), the typology shortlist with reasoning, the evidence requested and received to date, the control gaps identified, and a recommended next step (further investigation, formal case opening, or close with monitoring). Mark every factual claim that needs source verification with [VERIFY]. Do not include any statement that has not been established by the evidence.”
The failure mode: do not paste sensitive identifiers, names, or account numbers into a public model. Use placeholder tags ([EMPLOYEE_A], [VENDOR_3]) in the prompt, then fill the names back in offline once the draft is done. The [VERIFY] tags are your second line of defence. They force you to read every load-bearing claim before the memo leaves your hands.
A worked example, in 40 minutes
A compliance manager at a mid-sized insurer notices a vendor whose monthly invoices crept from $4,800 to $9,500 over four months, all approved by the same procurement officer. Stage 1 returns four typologies (vendor master manipulation, fictitious invoicing, kickback scheme, split purchasing). Stage 2 produces a 14-item evidence list. Stage 3 reveals that the dual-approval rule only triggered above $10,000, and the invoices had stayed deliberately below that line. Stage 4 lands a memo on the Head of Compliance’s desk the next morning, with verified facts and a clean recommendation. That workflow used to take a week of intermittent work.
What changes when you stop investigating from a blank page
The instinct stage of fraud detection has not changed. You still need years of pattern-recognition to feel that something is off. What AI changes is the cost of acting on the instinct. When the structuring overhead drops from hours to minutes, the threshold at which you escalate drops with it. Soft cases get investigated. Control gaps get found internally. The investigation file at the end of it reads like a senior auditor wrote it, because the framework that shaped it was the one a senior auditor would have used.