Remarkable Journeys with Jess Fox: Conversations with our clients, people and community. Listen now.
By: Paul Fontanot
01 Oct 2026 7 min read
The challenge is that decisive evidence is now often buried in vast volumes of email, chat, documents, invoices, ledgers and third-party data.
At the same time, the risk environment has shifted. Generative AI has made established fraud tactics more scalable, polished and personalised. Business email compromise, fake invoices, synthetic identities, account takeovers, chatbot-enabled social engineering and deepfake authorisations can now be created at speed and with few of the traditional red flags organisations have historically relied on. Poor grammar, unusual formatting or obvious inconsistencies are no longer reliable warning signs.
That matters because AI-enabled fraud often looks like business as usual. A request may appear to come from a trusted executive. An invoice may mirror a legitimate supplier’s format. A message may adopt the tone, timing and context of a real internal exchange. This creates a new detection problem: if fraudulent material is designed to appear ordinary, organisations need to move beyond surface-level review and towards broader, data-led analysis.
Used well, AI changes the economics of investigations. It does not replace investigators: it helps them move through the data-heavy stages faster and more consistently. Instead of relying on manual searches or first-pass review across large populations, AI-enabled tools can help cull duplicate and irrelevant material, identify themes, reconstruct timelines, surface relationships and prioritise the material most likely to matter.
In practical terms, this means an investigation team can focus senior time where it adds the most value: testing hypotheses, assessing credibility, applying professional judgement and forming defensible conclusions. AI can identify a potentially relevant email, explain why it may matter and point back to the underlying source. It can help investigators ask plain-language questions of a data set and receive evidence-backed answers. It can also detect unusual patterns in financial and transactional data that may not be visible through sampling or standard controls testing.
The strongest applications are not about speed alone. They are about improving the quality of review, reducing noise, broadening coverage and helping investigators see connections across evidence sources. This is particularly important in integrity matters, where the issue is rarely confined to one system or one document.
Most serious business integrity matters have two sides: what people said, and what the money did. Communications data, including email, chat, documents and attachments, can reveal knowledge, intent, concealment and relationships. Structured data, including ledgers, invoices, card transactions, vendor masters, payroll records and ERP extracts, can show how funds moved, whether approvals were bypassed, and whether transactions departed from expected patterns.
AI is most valuable when these streams are brought together. An anomalous payment in a ledger may only become meaningful when matched with surrounding emails. A pattern of supplier favouritism may be easier to prove when purchasing data is linked to communications and public-record research. A suspected conflict of interest may not be apparent from declarations alone, but may emerge through relationships between entities, bank accounts, employees and third parties. This is where forensic analytics becomes more than a review accelerator.
Full-population testing can identify duplicate payments, round-dollar or just-under-threshold approvals, dormant vendor reactivations, after-hours transactions, unusual approval patterns and links between staff and suppliers. Generative AI and technology-assisted review can then help investigators move quickly through the communications that explain the pattern.
The pressure to move faster should not obscure the central requirement of any investigation and that is findings must be capable of withstanding scrutiny. Boards, regulators, courts and affected individuals will not accept conclusions simply because an AI tool produced them. They need to know how the evidence was collected, how the analysis was performed, what was excluded, what assumptions were made and how outputs were validated.
That means AI-assisted investigations need to be designed with defensibility from the outset. Evidence should be preserved properly, with metadata, provenance and chain of custody maintained. Methodology should be documented and reproducible. Search criteria, exclusions, de-duplication steps, model performance and review decisions should be recorded. Outputs should be supported by citations back to source material wherever possible.
Most importantly, people remain accountable for the outcome. AI can prioritise and explain but experienced investigators must decide. Relevance, materiality, privilege, procedural fairness and adverse findings all require human judgement. The goal is not to remove the investigator from the process, but to make their work sharper, faster and better supported.
Integrity investigations involve sensitive personal, commercial, financial and privileged information. That makes data governance central to any AI-enabled approach. Client, employee or third-party data should not be placed into public or consumer AI platforms. It should remain in secure, contained environments with appropriate access controls, audit trails, privacy protections and hosting arrangements.
Organisations also need clarity on ownership. In many businesses, legal, risk, compliance, technology and investigation teams each hold part of the answer. Before a live matter arises, organisations should agree who is responsible for approving AI use, assessing vendors, managing privilege and privacy risks, validating outputs and explaining the methodology to senior stakeholders.
For internal integrity teams, the opportunity is broader than faster investigations. AI can support preventative and detective controls, helping organisations identify misconduct earlier and reduce reliance on manual, sample-based testing. This is particularly important where AI-enabled fraud is designed to avoid traditional warning signs.
A practical starting point is to review existing fraud and integrity controls through the lens of the new threat environment.
The next step is to decide what capability should sit internally and where an external partner is needed. Some organisations will build a lean internal analytics and triage capability, supported by external specialists for high-volume review, forensic collection, independent investigations or matters requiring regulator-ready methodology. Others may choose a hybrid model that gives the integrity team day-to-day visibility while retaining access to specialist technology and surge capacity when needed.
AI is now a mainstream part of the business integrity toolkit. Used responsibly, it can help investigators move through complex data faster, detect patterns earlier and produce clearer, better-supported findings. Used poorly, it can create false confidence, privacy risk and conclusions that cannot be defended.
The organisations that benefit most will be those that treat AI as part of a disciplined investigation model, combining secure technology, forensic methodology and human judgement. In an environment where bad actors are already using AI to make fraud more convincing, integrity teams need to understand both sides of the equation: how AI changes the threat, and how it can be used defensibly to respond.
If you’d like to discuss the use of AI in your fraud investigations, please reach out to our team of experts today.
Grant Thornton is pleased to announce the appointment of Paul Fontanot as the new National Head of Forensic Consulting, effective from Friday 25 September 2026
In this episode of Beyond the Numbers with Grant Thornton, we speak with Payroll Compliance experts Katherine Shamai and David Mintz to discuss the shifting payroll compliance landscape in Australia, understand how businesses should mitigate risk and the importance of proactive, continuous improvement in payroll processes.
Procurement is where money, discretion and relationships collide. When controls weaken under urgency, over‑delegation or poor documentation, misconduct can look legitimate on paper until patterns and context are tested.
