Suspicion of corporate fraud needs to be turned into a verifiable picture of events
BLACKFILE helps owners, boards of directors and legal teams verify indicators of corporate misconduct, reconstruct the sequence of decisions and determine which conclusions are confirmed by documents and independent sources
We analyze lawfully provided materials, corporate connections, available financial and digital traces and open sources. Legal qualification and decisions regarding participants remain the responsibility of the company, its attorneys and the competent authorities
At the initial stage, it is sufficient to describe the situation without names, documents or personal data of third parties.
SIGNAL
DECISION
PARTIES
COUNTERPARTY
VALUE FLOW
CONFIRMATION
GAP
02 / FIRST SIGNAL
A fraudulent scheme rarely appears in documents under its real name
Usually a company first notices individual inconsistencies: unusual exceptions from procedure, a recurring supplier, unclear authority, uncoordinated payments, or a discrepancy between reporting and actual outcome.
Each episode may have a lawful explanation. This is why an investigation must begin not with an accusation, but with preservation of materials, verification of authority, and construction of a timeline.
A signal becomes a conclusion only after verifying the connection between the decision, the benefit, and a confirming source.
03 / RECONSTRUCTION
The scheme is assembled from nodes, and each node rests on its own source
Fraud Pattern Reconstruction - the working logic of an investigation. Select a node to see what exactly is claimed, how it is verified, what has been confirmed, and what alternative explanation still remains possible.
FRAUD PATTERN RECONSTRUCTION
Confirmed by an available source
What is claimed
Procurement from a single supplier was carried out at an inflated price.
Verified by
Internal requisitions, comparable contracts from the same period, external benchmarks for the type of service.
What has been confirmed
The price deviation from the company's comparable contracts is documented.
Alternative explanation
Delivery urgency or a rare item type could have explained the markup.
Next source
Price justification attached to the procurement request.
Confirmed by an available source
What is claimed
The decision was made bypassing the standard procedure.
Verified by
The procurement regulation as in effect at that period and approval logs.
What has been confirmed
The approval route differs from the one required by the regulation.
Alternative explanation
A temporary exception was in effect, established by a separate order.
Next source
Orders and minutes introducing exceptions to the procedure.
Being verified: sources identified
What is claimed
One employee influenced the choice of supplier.
Verified by
Authority by position, composition of approvers, dates of participation in stages.
What has been confirmed
Participation in individual stages is confirmed - influence on the outcome is not.
Alternative explanation
The decision was made collectively, the participant's role was technical.
Next source
Minutes of the collective body and correspondence within the company's authority.
Confirmed by an available source
What is claimed
The counterparty is connected to one of the decision participants.
Verified by
Corporate registers of the jurisdiction of incorporation, history of structural changes.
What has been confirmed
An indirect connection is confirmed by a registry record as of the transaction date.
Alternative explanation
Matching surnames or address without an economic connection.
Next source
Beneficial ownership information available in the jurisdiction.
Gap: lawful sources are insufficient
What is claimed
The price difference accrued to a related party.
Verified by
Company payment documents lawfully provided.
What has been confirmed
Payments under the contract are confirmed. Further movement of funds - none.
Alternative explanation
The difference remained with the supplier as ordinary margin.
Next source
Counterparty information available only through an attorney request or a competent authority.
Being verified: sources identified
What is claimed
The combination of episodes forms a pattern, not coincidence.
Verified by
Recurrence across periods, cross-verification of each episode by a second source.
What has been confirmed
Recurrence is documented. Intent is a question outside the analyst's competence.
Alternative explanation
Coincidence of procurement practice in the industry during the same period.
Next source
Industry data and an opinion from a specialised expert.
Gap: lawful sources are insufficient
What is claimed
Earlier versions of the documents would have made it possible to establish the sequence of changes.
Verified by
Metadata within the access provided.
What has been confirmed
Part of the logs for the relevant period were not retained.
Alternative explanation
Routine rotation of storage systems, not concealment.
Next source
Backup copies, if they exist and the company is entitled to provide them.
The nodes are an anonymised working example of reconstruction, not materials from a specific project. Marked in red is the single material gap between what is claimed and what is confirmed.
01 Сигнал. Что заявлено: Закупка у одного поставщика проходила по завышенной цене. Чем проверяется: Внутренние заявки, сопоставимые договоры того же периода, внешние ориентиры по типу услуги. Что подтверждено: Отклонение цены от сопоставимых договоров компании зафиксировано документально. Альтернативное объяснение: Срочность поставки или редкая номенклатура могли объяснять надбавку. Следующий источник: Обоснование цены, приложенное к заявке на закупку. 02 Решение. Что заявлено: Решение принималось в обход обычной процедуры. Чем проверяется: Регламент закупки в редакции того периода и журналы согласования. Что подтверждено: Маршрут согласования отличается от обязательного по регламенту. Альтернативное объяснение: Действовало временное исключение, оформленное отдельным распоряжением. Следующий источник: Распоряжения и протоколы, вводившие исключения из процедуры. 03 Участники. Что заявлено: Один сотрудник влиял на выбор поставщика. Чем проверяется: Полномочия по должности, состав согласующих, даты участия в этапах. Что подтверждено: Участие в отдельных этапах подтверждено, влияние на итог - нет. Альтернативное объяснение: Решение принималось коллегиально, роль участника была технической. Следующий источник: Протоколы коллегиального органа и переписка в пределах полномочий компании. 04 Связанный контрагент. Что заявлено: Контрагент связан с кем-то из участников решения. Чем проверяется: Корпоративные реестры юрисдикции регистрации, история изменений структуры. Что подтверждено: Косвенная связь подтверждена реестровой записью на дату сделки. Альтернативное объяснение: Совпадение фамилий или адреса без экономической связи. Следующий источник: Сведения о бенефициарном владении в доступной юрисдикции. 05 Движение ценности. Что заявлено: Разница в цене поступила в пользу связанного лица. Чем проверяется: Законно предоставленные платежные документы компании. Что подтверждено: Платежи по договору подтверждены. Дальнейшее движение средств - нет. Альтернативное объяснение: Разница осталась у поставщика как обычная маржа. Следующий источник: Сведения контрагента, доступные только через адвокатский запрос или компетентный орган. 06 Подтверждение. Что заявлено: Совокупность эпизодов образует систему, а не случайность. Чем проверяется: Повторяемость по периодам, встречная проверка каждого эпизода вторым источником. Что подтверждено: Повторяемость зафиксирована. Умысел - вопрос вне компетенции аналитика. Альтернативное объяснение: Совпадение практики закупок в отрасли в тот же период. Следующий источник: Отраслевые данные и заключение профильного специалиста. 07 Пробел. Что заявлено: Ранние версии документов позволили бы установить порядок изменений. Чем проверяется: Метаданные в пределах предоставленного доступа. Что подтверждено: Часть журналов за нужный период не сохранена. Альтернативное объяснение: Штатная ротация систем хранения, а не сокрытие. Следующий источник: Резервные копии, если они существуют и компания вправе их предоставить.
The diagram does not prove fraud. It shows what part of the version rests on sources, where an alternative explanation remains, and what step could close the gap.
04 / SITUATIONS
What clients come to us with
None of these signals is proof by itself. Each becomes the subject of a separate check with its own source.
The price differs noticeably from comparable contracts of the company or external benchmarks, and no justification is present in the documents.
Verified byComparable contracts from the same period, price justification in the enquiry
Departures from procedure have ceased to be isolated and form a consistent practice.
Verified byThe regulation in the version in force at the time and approval logs
There are indications that a party to the decision has a relationship to the counterparty or its owners.
Verified byCorporate registers and the history of changes in ownership structure
Internal data, source documents, and external information describe the same transaction differently.
Verified bySource documents, warehouse and logistics confirmations
Contracts, rights or the client base transferred to a new company, and the economic logic of the transfer is unclear.
Verified byRegistry information, registration dates, terms of transfer
There is an external ground for a check, but it mixes facts, assessments and assumptions.
Verified byBreaking the report down into verifiable statements
Document versions or system records change after the question has already been raised.
Verified byMetadata and logs within the scope of access provided
PRESERVATION
The first decision in such a matter is not who to check, but which materials to preserve today, while they still exist.
05 / SCOPE OF WORK
Six areas checked separately and brought together
The composition of the work is defined by the specific incident, the client's authority and the availability of lawful sources. Each area provides its own level of confidence.
01
Decisions and authority
Who had the authority to make and approve the decision, what exceptions to procedure were permitted, and who documented them.
02
Corporate and personal connections
Connections between the parties to the decision and counterparties, based on lawful registries, corporate data and open sources.
03
Counterparties and beneficial control
Ownership structure, history of changes and actual control, to the extent disclosed in accessible jurisdictions.
04
Movement of economic value
Payments, obligations, rights and assets within the limits of data lawfully provided by the company and open information.
05
Documents and their chronology
Versions, dates, approval routes and changes made after the question arose.
06
External traces and independent sources
Court and regulatory information, publications, industry data and other lawfully accessible sources.
What these areas do not include
BLACKFILE does not obtain confidential banking data, internal correspondence without the company's authorization, or access to government databases. If a question can only be resolved using such sources, we state this directly and indicate who may lawfully obtain them.
06 / METHOD
From signal to report - a single route, with no shortcuts past verification
The order does not change: first legality and preservation, then hypotheses, and only then conclusions. The route passes through two checkpoints: until a checkpoint is passed, the next stage does not begin.
01
Verification of legality and conflict of interest
The legal basis for the task, the client's authority and the absence of a conflict of interest on BLACKFILE's own part are assessed.
02
Preservation and inventory of the materials provided
Each item of material is recorded with its origin and the date it was received, so that the original picture does not change during the process.
LEGAL GATEThe task is permissible, the materials are described
Without a lawful basis, the client's authority and an inventory of the materials received, the analysis does not begin.
03
Formulating questions and alternative hypotheses
The client's account is converted into verifiable questions. For each one, an alternative explanation is recorded from the outset.
04
Reconstruction of the timeline
Decisions, documents, payments and changes are arranged in sequence, linked to their sources.
05
Verification of connections and economic interest
Establishes who could have obtained a benefit and of what kind, and whether this is confirmed by the available data.
06
Cross-checking against independent sources
Internal information is checked against external sources: registries, publications, industry and court data.
SOURCE GATEEvery conclusion has a source
A statement without a named source does not pass this checkpoint and is not included in the report as established.
07
Verification of material conclusions by a second source
No material conclusion rests on a single document. If a second source is not available, the conclusion changes status.
08
Report with confidence limits
The client receives a picture of events, the status of conclusions, a list of gaps, and options for further lawful action.
07 / CLIENTS
Who approaches us and with what question
The client must have a lawful basis and the authority to set the task. Each role has its own question, and the scope of work depends on it.
A
Owners and shareholders
"Is my money going somewhere other than to me?" A picture is needed showing where a decision diverges from the company's interest.
B
Boards of directors
"What is what we were told based on?" An independent source is needed, not subordinate to any party to the conflict.
C
Legal departments and lawyers
"What of this will withstand scrutiny?" Sources, confidence limits, and a list of what to request next are needed.
D
Compliance and internal control
"Is this a one-off deviation or a system?" Recurrence across periods and verification of the procedure are needed, not a search for someone to blame.
E
Audit teams and auditors
"Why don't the figures match the transaction?" A factual basis is needed for the financial opinion that you provide.
F
Security and risk teams
"Where is the gap in our process?" A chronology of decisions and the points at which control failed are needed.
The status of an owner or manager does not by itself override employee rights or data processing requirements. Authority is verified before materials are obtained.
08 / RESULT
Material that can be brought to a lawyer, an auditor, or a board of directors
Not a data dump, but an assembled matter: eight parts of varying weight, each with its own purpose.
CASE FILE
01
Chronology of events
A sequence of decisions, documents, and payments linked to sources and level of confirmation.
02
Map of participants and related structures
Roles, authority, and confirmed connections without attribution of intent.
03
Table of decisions, authority, and exceptions
Who approved, on what basis, and how this differs from the usual procedure.
04
List of confirmed circumstances
Only what is supported by a document or an independent source, with that source indicated.
05
Register of contradictions and gaps
Where the data diverge from one another and which questions remain without a reliable answer.
06
Map of economic value movement
Within the accessible part: where payments, rights and assets went, based on lawfully obtained information
07
List of materials for lawyers and auditors
What and from whom it makes sense to request next, and under what authority this is done
08
Management summary
A short account without accusatory language: what has been established, what is assumed, and what the company decides
The engagement format is agreed before work begins. If the material is intended for use in a judicial, regulatory or disciplinary process, the client's legal team determines the requirements for admissibility and disclosure
09 / COMPOSITE EXAMPLE
A recurring supplier and decisions outside the normal procedure
Composite example. Circumstances have been combined and altered. It illustrates the method of work and does not describe a specific client
The owner noticed that one supplier systematically received exceptions on price and timing. Taken individually, each decision looked explainable. The check linked the chronology of approvals, changes in the counterparty's corporate structure and the periods when the employee was involved in supplier selection
Some of the initial assumptions were not confirmed. The report separately showed confirmed connections, unexplained discrepancies and documents that the company itself needed to request. The material was passed to the legal team for independent assessment
The value of the reconstruction lies not in confirming suspicion but in showing the limit between what is confirmed and what is assumed
What remained of the version after the check
Deviation of price from comparable contracts
Departures from the approval procedure
Connection of the decision-maker to the counterparty
Decision-maker's influence on the outcome
Benefit received by a related person
A schematic ratio, not a measurement: it shows how the version narrows in the course of verification. The bottom line marks the limit beyond which a legal request or a competent authority is required
SIGNALRecurring exceptions in favour of one supplier
Accepted as a question, not as a conclusion
DECISIONChronology of approvals
Compared with the procedure in effect at the time
PARTIESPeriods of the employee's involvement in supplier selection
Involvement confirmed, effect on the outcome - not confirmed
COUNTERPARTYChanges in the counterparty's corporate structure
Confirmed by registry records
GAPSome of the assumptions
Not confirmed by the sources available
HANDOVERHandover to the legal team
Assessment and decision rest with the company
10 / ENGAGEMENT FORMAT
Scale is determined by the number of episodes, participants, counterparties and jurisdictions
Three formats are apparent from the outset. The cost is stated after the initial assessment: before that, any figure would be invention
01One episode
Initial verification of a signal
Individual estimate after initial assessment
the timeframe is provided after the episode is described and the available materials are identified
A single episode and a limited set of sources: we check whether the signal has factual grounding.
What is included
breakdown of a single episode into verifiable questions
a limited set of lawful sources
verification of authority and conflict of interest
memo with an initial assessment and alternative explanations
recommendation on preserving materials
decision on whether a full investigation is required
02System of events
Full Corporate Investigation
Individual estimate after initial assessment
in stages; the timeline is fixed before each stage begins
Chronology, connections and the movement of economic value across the full system of episodes
What is included
several participants, divisions and counterparties
chronology of decisions, approvals and exceptions
map of connections and beneficial control within the accessible scope
movement of economic value based on lawfully provided data
register of contradictions and gaps
full analytical report with limitations on the level of confidence
03Multiple jurisdictions
International Coordination
Individual estimate after initial assessment
stage-by-stage reporting, with a separate timeline for each stage
Work across multiple jurisdictions with local lawyers and subject-matter specialists
What is included
several jurisdictions and languages
local lawyers and subject-matter specialists for each country
verification of admissibility in each jurisdiction separately
stage-by-stage reporting and checkpoint decisions
coordination with attorneys, auditors and the security team
separate materials for different authorized groups
The subject matter, sources, budget, scope of access and completion criteria are agreed before each stage begins. The timeline does not start when the form is submitted, but once the task has been agreed and an admissible set of materials has been obtained
11 / LIMITATIONS
What an investigation provides and what it does not
BLACKFILE takes on only lawful and proportionate tasks. Before work begins, the client's authority, the purpose of processing, the scope of data, the jurisdictions involved and the need for a qualified lawyer's involvement are assessed. An analytical assessment is not presented as established guilt
Limits of the result
the investigation does not establish criminal or civil guilt
suspicion, a complaint and publication are not evidence
data collection is limited by law and by the client's authority
deleted or inaccessible materials may leave a gap
the outcome does not guarantee recovery, dismissal, initiation of a case, or a court decision
legal conclusions are provided by counsel qualified in the relevant jurisdiction
These documents are used as professional reference points. BLACKFILE does not hold ISO certification. This page describes a general approach and is not legal advice: applicable requirements are verified separately for each jurisdiction.
If factual material is being prepared to support the legal team's strategy.
13 / QUESTIONS BEFORE STARTING
What is asked before the first conversation
An internal review starts with an incident: a complaint, a conflict of interest, a disputed decision. Here, the subject has already been narrowed down to a specific model of possible abuse and its economic consequences: who made the decision, who was connected to the counterparty, and where the value moved. The working logic is the same, but the set of questions and sources differs. Often one service transitions into another as the subject becomes clearer.
Yes, this is a common entry point. An initial signal check breaks a single episode down into verifiable questions and shows whether the suspicion has a factual basis. Quite often it turns out that the episode has a lawful explanation, and the work ends there. If signs of recurrence are confirmed, a full investigation is discussed.
No documents are needed at the first stage. It is enough to describe the situation: the type of signal, the approximate period, how many episodes, which functions are already involved, and what question needs to be resolved. Names, contracts, correspondence, and personal data of third parties should not be sent through the open form. The set of materials is agreed after checking admissibility and through a secure channel.
Yes, and this is most often how it happens. We handle the factual part: chronology, connections, sources, and the limits of certainty. Legal qualification is provided by counsel, financial conclusions by an auditor, technical expertise by a specialist in the relevant field. The division of roles is agreed before work begins, so that the result does not fall outside someone else's authority.
Only if the company has the right to provide such materials and the processing is necessary, proportionate, and permissible in the relevant jurisdiction. Personal accounts and devices do not become accessible for review by virtue of employment relations. BLACKFILE does not carry out unauthorized access to correspondence under any circumstances, and such a request will be declined.
Often yes, but the depth depends on the jurisdiction. In some places the ownership structure and beneficial owners are disclosed, in others only the nominal director, and in others the register is closed. For each country, source availability, admissibility of processing, and cross-border data transfer rules are checked separately. Before work begins, we state what can realistically be established in that particular country.
It remains in the report with its status and an indication of what data was missing. An unconfirmed version is not rewritten into a conclusion and does not disappear from the material. For the client, this is still a result: it becomes clear which part of the suspicion does not hold up under verification and which decisions cannot be based on it.
The report records sources, confirmed circumstances, assessments, hypotheses, and limitations, so it is suitable as working material for the legal team. But procedural admissibility in a specific jurisdiction is determined by counsel, not by the analyst. If the material is prepared from the outset for litigation, the requirements for collection, preservation, and format need to be agreed before work begins.
14 / INITIAL ASSESSMENT
Describe the signal. We will tell you what can be legally checked from it.
Do not attach documents, correspondence, personal data, or the names of the parties involved. A general description is enough for an initial assessment.
