01 Five conversations, one guide
The interview guide
Written for 20 to 25 minutes, in six parts:
- Opening and consent: 2 minutes
- Current practice, asked before the concept: 10 to 12 minutes
- The concept: About minute 13
- Evaluating the concept: 5 to 6 minutes
- One module for the participant's role: 4 to 5 minutes
- Pilot and closing: 2 minutes
Rules I held myself to
- Ask for the most recent real example before any general opinion.
- Keep what was observed apart from what was inferred, believed or made up in the interview.
- Treat confusion, rejection and existing alternatives as findings, and don't defend the concept.
- No recording unless permission and policy allow it.
02 What I heard, and what it changed
These come from my notes of the first conversation, with one practitioner. Words in quotation marks are as I wrote them down at the time; there is no recording.
Investigations move from an anomaly by checks.
What I heard: The duplicate invoice led to comparing versions, then file properties.
What it changed: Evidence always opens beside its source, and versions compare side by side.
The output is a deck or a report.
What I heard: Findings end up in “a ppt or a word doc”.
What it changed: The record is written as the work happens.
“All we can really give is suggestions.”
What I heard: Remediation depends on what each client will adopt.
What it changed: Interventions are proposals, each with an owner and a review window.
“Every fraud is extremely different.”
What I heard: Finding commonalities “may disregard nuance”.
What it changed: Reusing a finding elsewhere needs approval, and can be refused.
Another participant suggested the fraud triangle (pressure, opportunity, rationalisation) as the place to start if the work were about detection. Forensis starts after detection, and its intervention proposals all act on the same side of that triangle: opportunity.
03 How an investigation runs today
A matter usually starts with something that doesn't fit. In one practitioner's recent case, the same invoice arrived twice, minutes apart, in two different email chains. The second copy carried a higher amount, and the file properties showed it had been edited. From there the team works by checks: a question, a document, a narrower question. The finding ends up in a PowerPoint deck or a Word report. The explanations the team ruled out on the way, and why, mostly don't.
- Alert or allegationWhat survives: Blank: my notes don't say
- TriageWhat survives: Blank: my notes don't say
- Collect evidenceWhat survives: Blank: my notes don't say
- Working explanationWhat survives: Blank: my notes don't say
- ChecksWhat survives: LostMost of the explanations ruled out, and why
- FindingWhat survives: Blank: my notes don't say
- ReportWhat survives: KeptA PowerPoint deck or a Word report
- RemediationWhat survives: Blank: my notes don't say
- Kept
- Lost
- Blank: my notes don't say
ACFE's 2026 study of 2,402 cases found that more than half involved a lack of internal controls or an override of existing ones. North Quay turns on exactly that kind of override.
04 What's already out there
Secondary research
- ACFE, Occupational Fraud 2026: A Report to the Nations. The context: 2,402 cases in 143 countries, and more than half involved a lack of internal controls or an override of existing ones.
- EY, How AI can transform internal corporate investigations (April 2026). Why the record matters: auditability and human oversight “enable organizations to explain how investigative conclusions were reached”.
- NIST AI 600-1, Generative AI Profile (2024). The failure modes to design against: confabulation, and automation bias, “excessive deference to automated systems”.
- Heuer, Psychology of Intelligence Analysis (CIA, 1999), chapter 8. Analysis of Competing Hypotheses, the basis of the hypotheses matrix: plausible explanations compete “to see which ones survive a gauntlet of testing”.
- Albrecht, Iconic Fraud Triangle endures (ACFE Fraud Magazine, 2014). The fraud triangle's three elements: perceived pressure, perceived opportunity and rationalisation.
The tools
| Tool | Strength | What it leaves open |
|---|---|---|
| Relativity aiR for Case Strategy | Facts with citations, a timeline, a fact score | How a fact's status changed and who changed it |
| Hummingbird | Case management and data for financial-crime teams | How rival explanations are compared |
| Link-analysis platforms | Entities and connections | Why one explanation beat another |
| A general chatbot | A fast, fluent narrative | Provenance, alternatives, any record |
05 The brief changed
| Row | First brief, July | Final brief, September |
|---|---|---|
| The idea | A method for stress-testing a proposed fraud control before it ships | A case workspace for one matter, from the first anomaly to a finding with stated limits |
| It starts from | A confirmed fraud mechanism, supplied by the investigator | Something that doesn't fit: an alert or an allegation |
| The assistant's part | Generates plausible ways a scheme could still reach its goal once the control is in place | Suggests evidence, explanations and checks; a named person accepts or rejects each one |
| What comes out | Controls compared against the weakness several cases share | A finding with its reasons and exclusions, and a record of how it was reached |
| Learning across cases | The centre of the method: compare cases and extract a shared principle | Reuse needs approval, and is refused until independent cases support it |
Who it's for
Four roles touch a matter. I kept them as roles, with no invented faces, ages or quotes.
| Role | Job | What they need | What Forensis gives them |
|---|---|---|---|
| Investigator | Builds the matter day to day | To register sources, pull out evidence and test explanations | Source-pinned evidence, the hypotheses matrix and suggested checks |
| Investigation lead | Reviews and signs off | The reasons, and what's excluded | A finding that lists what it covers and what it excludes, with approval and reopening |
| Reviewer (legal or quality) | Reconstructs a conclusion months later | To see who decided what, and for which reasons | The record, with actor, reasons and version for every consequential event |
| Controls owner (client side) | Decides what to change | Proposals to weigh against what their organisation will adopt | Intervention proposals with an owner, a burden and a review window |
Problem statement
How might investigators use AI to move faster through a matter without letting a convincing story stand in for evidence, and leave a record another investigator could follow?
Principles
Suggestions stay suggestions.
The assistant can propose anything; only a named person changes what counts as established.
Evidence keeps its source.
Every item opens the passage it came from.
Explanations stay open until a check separates them.
Each one keeps its supporting and weakening evidence in view until a recorded check tells them apart.
A finding says what it doesn't establish.
A finding lists its excluded questions beside what it covers, and every evidence item carries what it can't show.
06 From nouns to objects
I listed every noun in my interview notes and the North Quay case files, then merged the ones that meant the same thing and struck the ones that turned out to be attributes, states, roles or things in the world. Eight objects were left, and a quieter second tier for what happens after a decision.
Noun foraging
- Matteralertallegation
- Sourceinvoiceemail chainERP record
- Evidenceduplicate warningoverrideexception paymenttechnician hoursrelationship
- Claimestablished fact
- Hypothesisexplanation
- Checkcheck
- Findingfinding
- RecorddeckWord report
Second tier
- Case snapshotpast case
- Principlecommonality
- Interventionremediationsegregation of duties
Struck
file propertiesOrigin, on SourceeditVersion, on SourceapproverA role: Investigation leadsuggestionA state: SuggestedscenarioResidual scenarios, on InterventionkeyIn the world: sources describe itvendorIn the world: sources describe itwork orderIn the world: sources describe itchange requestRecords sought, on Checksign-offAuthoriser, on FindingmanagerIn the world: sources describe itpaymentIn the world: sources describe it
Relationships
Read across a row to see where that object shows up inside the others. This matrix decides what every detail panel lists.
| Appears in | Matter | Source | Evidence | Claim | Hypothesis | Check | Finding | Record |
|---|---|---|---|---|---|---|---|---|
| Matter | Same object | The matter it decides | The matter every event belongs to | |||||
| Source | The Sources tab | Same object | Its origin, opened at the passage | The records searched, inside the search's limits | The reasons for an event | |||
| Evidence | The Evidence tab | Highlighted passages | Same object | Its reasons | Matrix rows: Supports, Weakens, Neutral or Not tested | The result it recorded | Linked reasons | The object of an event |
| Claim | The claims it supports | Same object | Claims whose reasons the result changed | What it covers, or an excluded question | The object of an event | |||
| Hypothesis | The Hypotheses tab, as matrix columns | The explanations it bears on | Same object | The explanations it should separate | The object of an event | |||
| Check | The Checks tab | The check that produced it | Checks that changed its reasons | The suggested next check | Same object | The object of an event | ||
| Finding | The Finding tab, every version | The finding that accepted or excluded it | Same object | The object of an event, with its version | ||||
| Record | The Record tab | Its activity, in the detail panel | Its activity, in the detail panel | Its activity, in the detail panel | Its activity, in the detail panel | Its activity, in the detail panel | Its activity, in the detail panel | Same object |
Matter appears in
- Finding
- The matter it decides
- Record
- The matter every event belongs to
Source appears in
- Matter
- The Sources tab
- Evidence
- Its origin, opened at the passage
- Check
- The records searched, inside the search's limits
- Record
- The reasons for an event
Evidence appears in
- Matter
- The Evidence tab
- Source
- Highlighted passages
- Claim
- Its reasons
- Hypothesis
- Matrix rows: Supports, Weakens, Neutral or Not tested
- Check
- The result it recorded
- Finding
- Linked reasons
- Record
- The object of an event
Claim appears in
- Evidence
- The claims it supports
- Check
- Claims whose reasons the result changed
- Finding
- What it covers, or an excluded question
- Record
- The object of an event
Hypothesis appears in
- Matter
- The Hypotheses tab, as matrix columns
- Evidence
- The explanations it bears on
- Check
- The explanations it should separate
- Record
- The object of an event
Check appears in
- Matter
- The Checks tab
- Evidence
- The check that produced it
- Claim
- Checks that changed its reasons
- Hypothesis
- The suggested next check
- Record
- The object of an event
Finding appears in
- Matter
- The Finding tab, every version
- Claim
- The finding that accepted or excluded it
- Record
- The object of an event, with its version
Record appears in
- Matter
- The Record tab
- Source
- Its activity, in the detail panel
- Evidence
- Its activity, in the detail panel
- Claim
- Its activity, in the detail panel
- Hypothesis
- Its activity, in the detail panel
- Check
- Its activity, in the detail panel
- Finding
- Its activity, in the detail panel
From model to navigation
The information architecture falls out of the model. Each tab is an object, and every object opens in the same right-hand panel.
Product
- MattersEvery matter, as one tableMatter
- ReviewsFindings waiting for a leadFinding
- InterventionsProposals across matters, with their review windowsIntervention
Matter
FX-2024-0417 North Quay service exception
Tabs
- OverviewThe allegation, key facts, open itemsMatter
- SourcesRegistered sources and their versionsSource
- EvidenceObservations, each opening its sourceEvidence
- Hypotheses (5)The matrixHypothesis
- Checks (5)Checks, what they searched and their resultsCheck
- FindingWhat it covers, reasons, exclusions, reuseFindingClaimCase snapshotPrinciple
- RecordEvery consequential event, in sequenceRecord
07 Controls as proposals
Remediation is the client's call, so Forensis frames controls as proposals.
| Proposal | Dependency it changes | Scenario that survives it | Operational burden |
|---|---|---|---|
| Block duplicate invoice numbers | One document route | A changed number or work order can preserve the same approval dependency. | Exception handling and legitimate revision review. |
| Independent proof of service | Unverified service confirmation | Collusion, fabricated traces, rubber-stamping and emergency override. | Verification ownership, access and payment delay. |
| Related-party disclosure and recusal | Compromised independence | Concealed ownership, undisclosed intermediaries or incomplete disclosure. | Relationship review, escalation and substitute approvers. |
All three are unevaluated proposals. No control is ranked by a score.
The 90-day review window
Independent service verification before exception payment, with disclosure and recusal review. The window runs 90 days after a proposed implementation. The process owner owns it and the control reviewer checks it. Each measure can come back Observed, Absent within review boundary or Indeterminate.
- Service-evidence rate
- Exception payments with independently reviewed service evidence / all exception payments in the observation window.
- Not observed
- Exception volume
- Count of exception-payment requests and approved exceptions within the observation window.
- Not observed
- Legitimate payment delay
- Elapsed time from complete legitimate submission to payment, compared with a defined pre-implementation baseline.
- Not observed
- Adaptation signals
- Reviewed indications of changed numbering, shifted work orders, collusion or emergency-override dependence.
- Not observed
08 What this can't show
Everything here runs on a fictional case, and the assistant's outputs are written by me to show the interaction. Nobody has used Forensis on a real matter, and I haven't run a usability test. The first test I'd run: give two investigators the same anonymised matter, one with a general-purpose chatbot and one with Forensis, then compare unsupported assumptions, alternatives considered, how much of the finding traces to evidence, and review time. If the structured version isn't clearly better than one good prompt, the framework hasn't earned its complexity.
09 Images and sources
Images
All four are public-domain works released through The Met's Open Access program. This page shows its images whole and untinted; the case page crops some of them.
- Alphonse Bertillon, Tableau synoptic des traits physionomiques: pour servir a l'étude du “portrait parlé”, ca. 1909. The Metropolitan Museum of Art, public domain.. Object page
- Invoice from Vilmorin-Andrieux et Cie, Paris, 24 August 1844. The Metropolitan Museum of Art, public domain.. Object page
- John F. Peto, Old Souvenirs, ca. 1881 to 1901. The Metropolitan Museum of Art, public domain.. Object page
- Attributed to William Notman, [Still Life with Books], 1870s to 80s. The Metropolitan Museum of Art, public domain.. Object page
Type
Neue Montreal for the pages. The product uses the system interface face with tabular numbers.
The case
North Quay is fictional. Its organisations, records and amounts were written for this project, and every fact on these pages comes from one case file.