Avoiding Mistakes in Forensic Audits
This paper outlines the top pitfalls that undermine forensic audits – with a South African case study and practical recommendations drawn from global best practices.
Are you making these forensic audit mistakes? Forensic audits are vital for uncovering fraud and enforcing accountability – but even experienced teams can fall into traps that compromise results.
From poor scoping and lack of independence to weak documentation and insufficient use of technology, the consequences of these errors can be severe – reputational damage, legal setbacks, and missed fraud.
This Duja Consulting paper breaks down the five most common forensic audit mistakes, including a South African case study (the SARS “rogue unit” investigation) and how your organisation can avoid these costly errors.
Learn how to conduct forensic audits that stand up to scrutiny and deliver tangible results.
Executive Summary
Forensic audits have become an indispensable tool for corporate governance and fraud detection, especially in South Africa’s high-risk business environment. A forensic audit is a specialised examination of financial activities, records and controls to uncover fraud, corruption or misconduct, often for use in legal proceedings.
By identifying financial irregularities and ensuring accountability, forensic audits support good corporate governance and help organisations protect stakeholder interests. However, even well-intentioned forensic investigations can be undermined by common mistakes. This white paper examines five frequent pitfalls in forensic audits – poor scoping, lack of independence, insufficient documentation, failure to follow legal procedures, and inadequate use of technology – and discusses how these missteps can harm companies in South Africa.
It highlights the consequences of such errors, including legal challenges, lost evidence, reputational damage and financial losses. A real-world South African case study (the 2015–2017 KPMG “rogue unit” investigation at SARS) is presented to illustrate how these mistakes can play out and what lessons can be learned. Drawing on insights and best practices from the Big Four consulting firms (PwC, Deloitte, KPMG, EY) and professional bodies, the paper provides practical recommendations to avoid these pitfalls.
Key recommendations include establishing clear terms of reference and scope from the outset, ensuring investigator independence and proper training, maintaining rigorous documentation and chain of custody for evidence, adhering strictly to legal and procedural requirements, and leveraging advanced forensic technology and data analytics.
By implementing these measures, organisations can enhance the effectiveness of forensic audits, thereby improving fraud detection, safeguarding their reputation, and strengthening corporate governance. This white paper is structured with an introduction to forensic audits, an analysis of common mistakes and their consequences, a detailed case study, and a set of actionable best practices for avoiding forensic audit failures.
Introduction
Corporate South Africa faces a persistent threat of fraud and economic crime. In fact, South African organisations report among the highest rates of economic crime in the world – 77% of companies in a recent PwC survey said they had experienced economic crime, far above the global average of 49%. In this context, forensic audits play a crucial role in detecting wrongdoing, enforcing accountability, and upholding good governance.
What is a Forensic Audit?
A forensic audit is a specialised examination of a company’s financial information, transactions, and control systems with the objective of uncovering irregularities such as fraud, corruption, or financial mismanagement. Unlike routine financial audits which focus on fair presentation of financial statements, forensic audits are investigative in nature – they “employ investigative techniques to uncover financial fraud and misconduct”. In practice, this means forensic auditors drill down into specific areas of concern, gather evidence of any wrongdoing, and often prepare findings for use in court or disciplinary proceedings. A hallmark of forensic audits is the emphasis on evidence that can withstand legal scrutiny; forensic auditors collect and preserve documentation, communications, and transactional data that may prove fraud or theft beyond reasonable doubt.
Role of Forensic Audits in Corporate Governance and Fraud Detection
Forensic audits have become an integral component of corporate governance frameworks. Strong governance is underpinned by transparency, accountability and risk management – and forensic auditing supports all three. By proactively identifying and addressing financial misconduct, forensic audits safeguard stakeholders’ interests and promote ethical business practices. Boards and audit committees often commission forensic investigations when there are red flags of fraud or when whistle-blower allegations surface, as a means to exercise due diligence and maintain oversight.
Within fraud risk management, forensic audits serve as both a detective and preventive control. The very prospect of an effective forensic investigation can deter potential fraudsters internally. When incidents do occur, a forensic audit helps organisations get to the bottom of what happened, who was responsible, how much was lost, and what control failures allowed it – invaluable insights for remediation. Forensic audit findings can lead to criminal charges or civil litigation to recover losses, thereby acting as a mechanism of enforcement. Top consulting firms emphasise enhancing traditional audits with forensic techniques to improve fraud detection; for example, EY has called for incorporating increased forensic testing and a “three lines of defence” model to better address fraud risk in audits. This reflects a broader recognition that auditors and investigators must evolve approaches to keep up with sophisticated fraud schemes.
In South Africa, forensic audits have played a prominent role in unravelling corporate scandals and public sector corruption. They have been instrumental in high-profile cases from private company accounting frauds to government procurement scandals. By strengthening the ability to detect and address economic crimes, forensic audits ultimately reinforce the rule of law and investor confidence in the market. However, the effectiveness of a forensic audit can be severely compromised if certain common mistakes are made during the investigation process. The next section examines these frequent pitfalls in detail.
Common Mistakes in Forensic Audits
Despite the best of intentions, forensic audits can go awry due to avoidable errors in approach or execution. Leading practitioners and global firms have observed that most failures in forensic investigations trace back to a handful of common mistakes. Understanding these pitfalls is the first step to ensuring a forensic audit achieves its objectives. Below we discuss the five most prevalent mistakes made during forensic audits, namely: poor scoping, lack of independence, insufficient documentation, failure to follow legal procedures, and inadequate use of technology. We explore what each mistake entails and why it tends to occur.
2.1 Poor Scoping and Planning
One of the foundational steps in any forensic audit is defining its scope – essentially, what is being investigated and to what extent. Poor scoping refers to failing to establish clear objectives, boundaries and priorities for the investigation at the outset. If the plan is rushed or vague, the forensic team may pursue irrelevant leads, overlook key issues, or expend resources inefficiently. A rushed and unstructured approach could lead to the loss of important evidence as well as confusion among stakeholders. In other words, without a solid initial plan, critical data might not be secured in time and the investigation can meander off-track.
Common signs of poor scoping include unclear terms of reference, no defined timeline or budget, and investigators being uncertain about what allegations or risks they are addressing. For example, launching a broad “find any fraud” fishing expedition is a recipe for trouble – it virtually guarantees wasted effort and stakeholder frustration. Investigation experts stress that a carefully conducted initial assessment is indispensable; at the start, investigators should gather background information, identify specific suspicions, and decide on the preliminary focus. Cindy Hofmann of KPMG Forensic advises asking key questions during planning: What are the allegations based on? Who are the people involved? What is the potential financial impact? Has any law likely been broken? What immediate actions are needed? By answering these, one can calibrate the scope appropriately – for instance, narrowing the audit to a particular contract, division or time period where irregularities are suspected, rather than auditing everything everywhere.
Poor scope definition often leads to scope creep, where investigators keep expanding into new areas without clear justification, causing delays and cost overruns. Conversely, it may also result in blind spots – important segments or transactions left out of review because the scope was too narrowly defined or key data sources were not identified. Indeed, failing to set clear goals for the investigation upfront is cited as a major pitfall; without explicit goals and hypotheses, forensic auditors may end up “finding a needle in a haystack” without knowing which needle they are looking for. Leading practices therefore recommend that investigators “always set clear goals for the investigation upfront” and draft a detailed scope document or investigation plan that is agreed by those commissioning the audit. This plan should outline the specific issues to probe, relevant timeframe, business units or accounts to be examined, and the approach for evidence gathering.
Another aspect of scoping is resource planning – assembling the right team and tools. Inadequate planning might mean critical expertise (IT forensics, legal counsel, data analytics) is brought in too late or not at all. The Big Four firms often deploy multidisciplinary teams in complex investigations, precisely to cover all angles. A well-scoped forensic audit will define roles and ensure everyone knows the mandate. Staying within the mandate is crucial; investigators must “limit themselves to fact-finding and refrain from exceeding the scope of [their] mandate”, as South African forensic standards advise. If the scope or mandate is unclear, investigators might overstep (or underperform), which can later render the findings invalid.
In summary, poor scoping sets the stage for failure by misdirecting the audit from the start. The remedy is thorough upfront planning: define the scope clearly in consultation with stakeholders, set objectives and priorities, and map out a strategy. This ensures the investigation is focused, efficient, and aligned with its intended purpose.
2.2 Lack of Independence and Objectivity
Forensic auditors must be, and be seen to be, independent and objective. Lack of independence is a critical mistake that can fatally undermine the credibility of a forensic audit. This mistake manifests when those conducting the investigation have conflicts of interest, biases, or undue influence from parties involved in the matter. If an investigator stands to gain from a particular outcome or has a close relationship with the subjects of the audit, their findings will naturally be viewed with scepticism. In the worst cases, compromised independence can lead to deliberate cover-ups or skewed reports.
A hallmark of forensic engagements by firms like PwC, Deloitte, KPMG, and EY is the emphasis on integrity and ethical conduct. Investigators are bound by professional codes to remain impartial. For instance, the Association of Certified Fraud Examiners (ACFE) Code of Professional Conduct explicitly prohibits fraud examiners from expressing opinions on the guilt or innocence of any party – their job is to present facts and evidence, not to prosecute or defend. Similarly, South Africa’s Institute of Commercial Forensic Practitioners (ICFP) standards direct that practitioners “restrict their reports to the scope defined” and avoid statements that a transgression has definitively occurred. These guidelines aim to ensure objectivity and prevent investigators from acting as judge and jury.
Independence can be compromised in subtle ways. For example, if an internal auditor or compliance officer is tasked with investigating their own department or superiors, there may be implicit pressure to downplay findings – a case of the proverbial “marking one’s own homework.” In high-stakes investigations, senior executives might attempt to steer the scope or influence conclusions. Even external forensic firms might face conflicts, as seen in some scandals where audit firms had lucrative consulting relationships with the very companies they were to investigate. The Big Four in South Africa have learned hard lessons here: KPMG, for instance, was found to have ignored “red flags” in its dealings with the Gupta family (in the state capture saga) due in part to a lack of scepticism and prolonged close ties. This eventually led to a public loss of trust in KPMG’s independence in those matters.
A lack of objectivity also shows up in reporting style. If a forensic report uses biased or accusatory language, or makes legal conclusions about culpability, it signals a loss of impartial tone. An investigator’s role is to present evidence and, if required, an expert opinion – but not to assign guilt (unless specifically mandated as, say, a disciplinary chair). South African case law demonstrates the perils of overstepping: in the Maru case (2025), a departmental investigator issued a report with “adverse findings of culpability” against employees, including terms like “fraudulently” and “in cahoots” – effectively pronouncing them guilty. The High Court set aside that report for having acted beyond scope and without giving the employees a fair chance to be heard. The lesson is clear: forensic auditors should stick to factual findings and avoid becoming advocates. Maintaining a neutral, fact-based reporting style reinforces that the investigation was objective.
In practice, ensuring independence means selecting the right people for the job. Companies should engage investigators who have no stake in the outcome and, preferably, who are members of recognised professional bodies with strict ethics codes (such as ACFE or ICFP in South Africa). Often this means using external forensic consultants or rotating internal teams from different units. It also means disclosing any potential conflicts at the start and addressing them. The engagement letter for a forensic audit should guarantee the investigator’s full access and freedom from interference.
In summary, independence is the bedrock of credibility in a forensic audit. A lack of it is a grave mistake that can nullify even the most technically competent investigation. Organisations must thus choose their forensic auditors wisely and empower them to act impartially. As the saying goes, “sunlight is the best disinfectant” – only an independent inquiry can bring full clarity to dark dealings
2.3 Insufficient Documentation and Evidence Management
Forensic audits hinge on evidence. The strength of any findings is only as good as the underlying proof collected and how well it’s documented. A common mistake in forensic audits is insufficient documentation – failing to properly record, organise, and preserve the evidence and investigative work. This can range from poorly kept working papers and missing audit trails, to neglecting chain-of-custody forms for physical evidence or not documenting interviews thoroughly. The consequences of such lapses are severe: if evidence is not admissible or credible, the entire investigation’s conclusions may collapse.
One key area is maintaining the chain of custody for evidence. This refers to the chronological documentation that records how evidence was collected, handled, transported, and stored from the point of discovery to its presentation (often in court). If the chain of custody is broken or not recorded, an opposing party can easily challenge the integrity of the evidence – suggesting it may have been tampered with or mixed up. For example, if a forensic auditor takes possession of a laptop containing suspected fraudulent transactions, it must be logged (time, date, from whom) and stored securely; any analysis performed on it should be recorded. KPMG experts warn that if the chain of custody is not maintained, the evidence obtained might be ruled inadmissible in court, and indeed they have seen cases where lawyers attack the evidence collection process to undermine the investigation. The rule of thumb is to treat every case as if it will end up before a judge – “each and every investigation should be conducted in such a manner that the evidence is admissible in court.”
Beyond chain of custody, documentation encompasses taking detailed notes and securing all relevant records. Consider interviews: forensic auditors typically conduct interviews of suspects and witnesses. If these are not well-documented – e.g. no written transcripts or signed minutes – the interviewee might later dispute what was said. Best practice is to have two investigators in important interviews and to have the interviewee review and sign the notes or a statement for accuracy. This creates a reliable record that can be used as evidence or for reference. An insufficiently documented interview (or none at all) can lead to “he said, she said” disputes that weaken the case.
Documenting the investigative steps is also important. For instance, if data analysis was performed on financial records, the forensic team should retain copies of the datasets, the criteria used (keywords, date ranges), and the results of queries. This ensures that the work is transparent and reproducible if scrutinised. A mistake sometimes seen is investigators failing to keep an organised case file – later struggling to show how they reached a conclusion because supporting documents are scattered or missing. Using a standard evidence register and index of findings can help avoid this.
In the digital age, the volume of electronic evidence (emails, databases, logs, etc.) is massive. A mistake is not leveraging tools to manage these or not capturing them properly. For example, if an investigator prints a few emails as evidence but doesn’t preserve the full email mailbox with metadata, they risk omitting context or authenticity details. Leading firms now use forensic imaging and e-discovery software to collect entire email accounts or device images, preserving all data with hashes to prove integrity. Failure to do so can mean key evidence is overlooked or cannot be verified. Increasing digitalisation means one can and should gather more electronic evidence than before – but also handle it efficiently. Using proper forensic software ensures even deleted or hidden files can be recovered and that a defensible copy of data is retained for court. Not using such tools (due to cost or oversight) can be a false economy if crucial evidence is missed.
Finally, insufficient documentation also refers to the report itself. A good forensic report should clearly document the procedures followed, evidence relied upon, and analysis performed, alongside the findings. If the report lacks references to exhibits or doesn’t explain how conclusions were drawn, it may be deemed unsubstantiated. Auditors sometimes make the mistake of providing a thin “executive summary” style report due to time pressure, but for forensic purposes, more detail is usually better – an annex of evidence, timelines, transaction flowcharts, etc., adds weight to the conclusions.
In sum, meticulous documentation is the lifeblood of a credible forensic audit. Avoiding this mistake requires discipline: maintaining logs, notes, and evidence files religiously throughout the investigation. It also requires applying formal evidence management procedures, such as chain-of-custody protocols and secure evidence storage (both physical and digital). The payoff is significant: well-documented evidence can be the difference between an investigation that achieves accountability and one that falters when challenged.
2.4 Failure to Follow Legal Procedures and Protocols
Forensic audits often operate at the intersection of accounting, law, and corporate policy. A frequent pitfall is the failure to follow the proper legal and procedural protocols that govern investigations. This mistake can invalidate an otherwise solid investigation or even expose the company to liability. Key aspects include respecting the rights of individuals (procedural fairness), complying with privacy and data protection laws, and adhering to any regulatory requirements for investigations. Especially in South Africa – a constitutional democracy with strong labour laws and a robust legal system – forensic auditors must be acutely aware of the legal parameters of their work.
One major consideration is procedural fairness, encapsulated in the audi alteram partem principle (“let the other side be heard”). If a forensic investigation makes adverse findings about an individual – for example, an employee or contractor – without giving them an opportunity to respond to the allegations, that individual might later challenge the findings as unjust. This is not merely theoretical: South African courts have scrutinised high-profile forensic reports on this basis. In the case of the “Great Bank Heist” report on the VBS Bank scandal, an implicated official (Mr. Msiza) sued, claiming he was not given a chance to be heard. While an initial ruling sided with him, on appeal the court found the report’s references to him were not actual legal decisions but rather evidence recordals, so full-blown procedural fairness was not triggered. Nevertheless, the scenario underscores that investigators must carefully consider whether – and when – to interview or invite rebuttals from those they are investigating. In another case (Maru v MEC for Transport, 2025), a forensic investigator’s report was overturned because it “acted beyond the scope of his mandate” and made conclusive findings without affording the employees a proper hearing. The court held the report was to be set aside for these procedural failings. The takeaway: skipping procedural steps, like failing to interview the subject of the investigation or not allowing them to explain documents that implicate them, can render the outcome unlawful, especially if that outcome is used to take action (firing someone, etc.).
Another legal aspect is evidence admissibility, which we touched on with chain of custody. If investigators do not obtain evidence in a legally sound manner, it can’t be used. For instance, in South Africa, monitoring or seizing private communications requires adherence to privacy laws (like the Regulation of Interception of Communications Act). A forensic audit that, say, hacks into personal emails or seizes an employee’s phone without consent or following legal procedure could violate rights and get the evidence thrown out – or lead to lawsuits against the company. Data protection and privacy laws impose restrictions on accessing and using private information gathered in a company’s investigation. Investigators must coordinate with legal counsel to ensure they have authority (through consent, law, or policy) to collect certain information. This is particularly important for cross-border investigations, where multiple jurisdictions’ laws (GDPR in Europe, for example) may apply.
Furthermore, forensic auditors should follow any industry-specific regulations or guidelines. For example, banks and public companies often have regulations requiring certain reports to be made if fraud is discovered, or requiring involvement of external auditors. If a forensic audit is looking into financial statement fraud, it may need to interface with the company’s external auditors or regulators like the JSE or FSCA. A mistake would be ignoring these obligations – e.g. not reporting a discovered fraud to authorities when required by law (such as South Africa’s Prevention and Combating of Corrupt Activities Act, which mandates reporting corruption over a certain amount).
There are also internal protocols: companies usually have disciplinary codes and investigation procedures (especially for public sector, guided by PFMA or MFMA in SA). If forensic auditors bypass the HR protocols – for example, by not informing internal audit or by interviewing staff without observing labour protections – the process can be challenged later. Thus, aligning the forensic audit with the organisation’s internal policies is necessary.
In essence, a forensic audit must be as procedurally sound as it is substantively effective. Violations of legal principles or due process can make an investigation futile, exposing the company to legal challenges and nullifying its findings. Avoiding this pitfall means planning the investigation hand-in-hand with legal advisors: ensuring that terms of reference are lawful, that proper notice is given where needed, that evidence is collected under the correct authority, and that the rights of individuals (to privacy, to fair hearing) are respected appropriately. It may also involve obtaining specialist legal opinions when dealing with complex areas like search-and-seizure or cross-border data. As one forensic expert aptly put it, “Justice pursued without fairness risks becoming injustice in disguise.” Following the rules is not a bureaucratic burden – it is fundamental to achieving an outcome that stands up under scrutiny.
2.5 Inadequate Use of Technology and Data Analytics
Modern frauds leave digital footprints, and forensic audits that rely solely on manual techniques or outdated tools risk missing the plot. An increasingly common mistake is failing to leverage technology and data analytics to the fullest extent. In today’s data-driven business environment, valuable evidence is often buried in large datasets, emails, server logs, and cloud systems. If investigators do not use appropriate forensic technology – data analytics software, e-discovery platforms, digital forensics tools – they may overlook patterns of fraud or spend excessive time sifting data that a computer could analyse efficiently.
The “digital weak spot” can be a critical failure given the size and complexity of many organisations. For example, consider a procurement fraud: thousands of invoices and payment records may need to be analysed to spot anomalies like duplicate payments or suspicious vendor patterns. Traditional auditing on a sample basis may not catch these, whereas data analytics can test 100% of transactions and flag outliers. Top consulting firms advocate for integrating advanced analytics in forensic work. Deloitte, for instance, notes that as fraudsters become more tech-savvy and fraud schemes more subtle, organisations are forced to use integrated data analysis tools to discover potentially fraudulent transactions. Put simply, the old ways of combing through files manually are not sufficient when facing large-scale or cleverly concealed fraud.
Specific technologies that have become essential include: data mining software to detect trends and outliers in financial data; visualisation tools to map relationships between entities or money flows; and digital forensics utilities to image devices and recover deleted information. If an audit team lacks these capabilities, they might miss, for example, that a certain employee ID appears across many suspicious transactions, or that several suspicious emails were exchanged just before a contract award. Inadequate technology use also shows when teams rely on spreadsheets for everything, instead of using databases or specialised audit tools – this can introduce errors and limits analysis depth.
Another dimension is early case assessment and e-discovery in handling communication data. Modern investigations often involve reviewing troves of emails and documents. Tools like Brainspace or Nuix can rapidly index and allow keyword searches, topic clustering, and identifying who communicated with whom and when. Using such tools can help develop themes and pinpoint issues early in an investigation. A mistake would be to attempt manual email reviews which are not only painfully slow but prone to human error. For instance, manually reading thousands of emails could result in missing a key thread, whereas an analytics tool could flag conversations containing certain risk terms (like “invoice adjustment” or “delete”). KPMG’s forensic practice highlights methods like Visualization dashboards and Technology Assisted Review (TAR) which let investigators quickly spot anomalies (e.g., unusually frequent contacts between an employee and a vendor, or documents with altered metadata). Not employing these is a missed opportunity.
In the South African context, inadequate technology use is especially risky given the prevalence of sophisticated financial crime. From collusive tender fraud networks to cyber-enabled theft, perpetrators often exploit technology to their advantage. Forensic teams must therefore counter with equal or better technology. A case in point: if investigating possible collusion in bid tenders, network analysis software can map connections between bidders (common directors, addresses, bank accounts) far more effectively than a person could. Similarly, forensic data analytics can apply Benford’s Law or other statistical techniques to flag irregularities in large datasets – techniques which have been successfully used by firms to detect procurement and accounting fraud in Africa.
Lastly, inadequate use of technology can make the audit less efficient and more costly. Manual tasks that could be automated will consume extra time. This not only delays the outcome (which might be critical if fraud is ongoing) but also drives up billable hours or internal costs. As noted in one PwC survey, a significant portion of companies end up spending “twice to ten times as much on investigations as the original amount lost” to the economic crime. While some of that is unavoidable, better use of forensic tech can reduce investigation time and thereby cost.
In conclusion, failing to embrace technology is a mistake that can leave a forensic audit blind to crucial evidence and inefficiencies. The solution is clear: invest in the right tools and skills. Today’s forensic auditors need proficiency in data analytics and IT forensics alongside traditional accounting know-how. By using advanced software and techniques (and indeed, even emerging tools like AI for anomaly detection), forensic audits can keep pace with complex fraud schemes and ensure no stone is left unturned.
Consequences of Forensic Audit Mistakes in South Africa
Mistakes in a forensic audit can significantly undermine its effectiveness and carry serious consequences for the organisation involved. In South Africa’s context – where corporate malfeasance and corruption are hot-button issues – the fallout from a botched forensic investigation can be particularly severe. Below we outline the key consequences that companies may face if the aforementioned mistakes occur during a forensic audit:
- Failed Investigations and Missed Fraud: The most direct consequence is that the fraud or misconduct might not be properly uncovered or evidenced. If poor scoping causes investigators to look in the wrong place, the true scheme could go undetected, allowing culprits to escape accountability and potentially continue their wrongdoing. Inadequate use of technology might similarly result in missing subtle patterns of fraud. For a company, this means the root problem remains unresolved – losses may continue and the opportunity to recover funds or assets is lost. In a country where 77% of organisations have experienced economic crime, failing to root out an issue can be very costly.
- Legal Inadmissibility and Enforcement Issues: Mistakes such as insufficient documentation or procedural missteps can render evidence inadmissible in court or other proceedings. If chain of custody wasn’t maintained (e.g., key documents’ handling wasn’t logged), a court may refuse to consider that evidence, crippling any legal case against fraudsters. Likewise, if suspects weren’t given a fair chance to be heard, they could obtain court interdicts preventing the company from acting on the report. We have seen South African courts set aside forensic findings when process was flawed. The consequence is that wrongdoers might avoid prosecution or disciplinary action due to technicalities, and the company cannot achieve justice or restitution. In high-profile corruption cases, this can also be a public relations disaster if a much-touted investigation ends with no legally enforceable result.
- Reputational Damage and Trust Deficit: A bungled forensic audit can backfire on the organisation’s reputation. If word gets out that the company conducted a shoddy investigation – for instance, one perceived as a “witch hunt” lacking independence, or conversely a whitewash – stakeholders will lose confidence in the company’s governance. South African businesses operate under public and investor scrutiny, especially post the corporate scandals of recent years. An example is KPMG South Africa’s experience: when it emerged that their “rogue unit” investigative report for SARS was deeply flawed, it wasn’t just KPMG’s reputation that suffered; SARS and the involved government officials were also embroiled in controversy for having relied on it. Companies that handle internal investigations poorly may be seen as complicit or incompetent in dealing with fraud, eroding trust among shareholders, regulators, and the public.
- Financial Losses and Wasted Costs: Forensic audits are expensive undertakings, often requiring specialised skills and tools. A mismanaged investigation can lead to escalating costs with little to show for it. There is the direct cost – if scope creep or inefficiency due to poor planning occurs, fees and internal costs balloon. Moreover, if the investigation fails to stop a fraud, the financial losses from the fraud continue to mount. In South Africa, where some frauds (like procurement scams) run into millions or billions of rand, the stakes are high. Consider also potential penalties: failure to follow certain legal procedures (like not reporting corruption above a threshold) could mean regulatory fines. And if an innocent employee is wrongly implicated due to an investigative error (for example, due to inaccurate analysis or bias), the company could face wrongful dismissal lawsuits or labour tribunal penalties.
- Loss of Management and Employee Morale: Internally, a forensic audit gone wrong can damage morale and culture. If employees see that an investigation was unfair or error-ridden, it can create cynicism and fear. Good employees might fear being falsely accused, and wrongdoers might feel emboldened if they see the company cannot catch or punish them effectively. The Duja Consulting analysis on training points out that unreliable audits breed “complacency or cynicism among employees” and weaken the overall control environment. In South Africa, where whistleblower trust is fragile, a company that mishandles a forensic audit might discourage future whistleblowers from coming forward (they might think the company will bungle it or not take proper action).
- Regulatory and Investor Fallout: Especially for listed companies or those in regulated industries, a poor forensic outcome can invite regulatory scrutiny. The Johannesburg Stock Exchange (JSE) or other regulators could question whether the company breached any duties by not conducting a proper investigation. Investors may mark down the share price if they feel potential fraud risks remain or if governance appears weak. In extreme cases, audit failures contributing to scandals (like at Steinhoff in 2017 or Tongaat Hulett in 2019) have led to stock crashes and long-term damage to shareholder value – highlighting that the quality of forensic and audit processes directly ties to financial performance and investor confidence.
In summary, the consequences of these mistakes span legal, financial, and reputational dimensions. South African companies, already operating in a fraud-prevalent environment, can ill afford a failed forensic audit. The costs can be seen not just in rands lost, but in lost opportunities to enforce accountability, in trust damaged among stakeholders, and even in careers of executives (since boards and CEOs are increasingly being held accountable for how they handle fraud incidents). This underscores why avoiding the pitfalls discussed is so important – a theme we turn to with a real-world example next.
Case Study – The SARS “Rogue Unit” Forensic Investigation
To illustrate how these common mistakes can manifest and the repercussions that follow, we examine a prominent South African case: the 2015–2017 forensic investigation into the so-called “rogue unit” at the South African Revenue Service (SARS). This case, involving audit firm KPMG, demonstrates multiple pitfalls – from questions of scope and independence to documentation and legal procedure issues – and highlights lessons for organisations conducting forensic audits.
4.1 Background of the Case
In 2014, allegations surfaced of an illicit intelligence unit operating within SARS (the tax authority). The unit was accused by some of spying on taxpayers and political figures without authorization. To address the controversy, SARS commissioned KPMG South Africa to conduct a forensic investigation and report on the existence and activities of this “rogue unit.” By 2015, KPMG had produced a lengthy forensic report which concluded that a covert unit had operated unlawfully and implicated several SARS officials (including former Commissioner Pravin Gordhan, then Finance Minister, as having oversight responsibility). The report’s findings were explosive: they were used to justify disciplinary actions and even figured in the decision to remove Minister Gordhan from his post.
However, almost immediately, the report drew criticism. Other earlier investigations (by a panel led by Adv. Sikhakhane and an internal SARS team) had touched on similar allegations, and it appeared KPMG’s report heavily relied on – or even copied from – those prior reports. Questions arose about the accuracy of the findings and the fairness of the process. By 2017, in the wake of public outcry and broader scrutiny of KPMG’s conduct in state-related engagements, KPMG itself announced it was withdrawing the conclusions and recommendations of the SARS report, essentially disavowing its own work. This unprecedented move rocked the accounting and business community.
4.2 Mistakes Made and Their Impact
Several of the common mistakes in forensic audits were evident in the SARS “rogue unit” investigation:
- Lack of Independence/Objectivity: KPMG’s independence was severely questioned. It emerged that some KPMG senior personnel had cozy relationships with the very government factions pushing the rogue unit narrative. Moreover, KPMG had longstanding consulting and audit relationships with government entities. While KPMG denied political bias, the perception was that the investigation may not have been objective. Indeed, the firm later admitted that the report “fell short of KPMG’s standards” and apologised. The language of the report was also problematic – it effectively accused officials of running a rogue spy unit (a potentially criminal finding) without solid evidence, indicating an overreach in conclusions. This lack of impartial tone and rigour fed the impression that the report was a predetermined hatchet job rather than a fair investigation.
- Poor Scoping and Methodology: KPMG’s report was criticised for leaning heavily on earlier reports instead of gathering fresh evidence. This suggests a scoping issue – rather than independently verifying facts, the team might have operated within a narrow frame set by what SARS management wanted. If the terms of reference given to KPMG were biased or incomplete (for example, if they were expected to confirm the unit was “rogue” rather than neutrally investigate its lawfulness), then the scope was flawed from inception. Additionally, by possibly plagiarising sections of previous reports, KPMG failed to plan an independent fact-finding approach. This short-cutting is akin to poor planning – not mapping out how to collect original evidence, but instead recycling allegations. The consequence was a report that could not stand up to scrutiny, since it added little new substantiated information.
- Insufficient Documentation and Evidence Issues: One major issue was that no solid, admissible evidence of criminal wrongdoing by the SARS unit was documented in the report. For instance, while it alleged unlawful interception of communications, it did not produce concrete evidence of such. The affected parties (officials named) stated they were never shown evidence or given a chance to respond to specific claims – hinting at a lack of documented proof and engagement. When pressed after the fact, KPMG could not defend its findings with hard evidence, which is a key reason they withdrew them. In essence, whatever evidence-gathering was done, it was insufficient or not properly documented to back the sensational conclusions.
- Failure to Follow Procedural Fairness: SARS used the KPMG report to take action against various employees and to publicly tarnish reputations (e.g., of Mr. Gordhan and others). However, those individuals were not interviewed by KPMG during the investigation, nor given an opportunity to present their side. This violates basic investigative fairness protocols. It opened the door for legal challenges – indeed, some officials pursued legal recourse for defamation and unfair dismissal. The situation mirrors the Maru case lesson: KPMG’s investigator (in this case, the firm itself) arguably acted beyond mandate by making conclusive findings of “rogue” conduct without involving the implicated in the process. The fallout included serious questions about legality and an acknowledgment by SARS later that the report could not be used to take further action.
- Consequences: The outcome of these mistakes was disastrous for nearly all involved. SARS’s credibility suffered, as it appeared to have commissioned a biased report to target certain people. The individuals named had their careers and reputations harmed (some were pushed out of SARS or sidelined, only to be essentially vindicated later when the report was retracted). KPMG South Africa faced a firestorm of reputational damage: major banks and companies terminated KPMG as their auditor in protest, and the firm lost a slew of clients and revenue. The CEO and several partners of KPMG SA resigned in the wake of the scandal. The audit regulator (IRBA) launched investigations into KPMG’s conduct. In essence, the mistakes in this forensic audit nearly crippled one of the Big Four firms’ local operations – a stark warning. It took years of rebuilding for KPMG to begin regaining trust in South Africa.
From a governance perspective, the SARS case demonstrates how a mishandled forensic audit can fuel a governance crisis rather than resolve it. Instead of providing clarity, the flawed report exacerbated divisions and controversies. It stands as a cautionary tale that a forensic investigation must be executed with utmost professionalism; otherwise, it can produce false narratives that mislead decision-makers and the public.
4.3 Lessons Learned
The SARS “rogue unit” case yields several key lessons aligned with our discussion of common mistakes:
- Ensure True Independence: SARS might have been better served by choosing a firm (or a panel of experts) without any conflicting ties, or by clearly empowering the investigator to be impartial. Engaging specialists with impeccable independence – perhaps even from outside South Africa – could have removed suspicion of bias. For firms, the lesson is to rigorously check that no client relationship or internal culture issue will compromise the investigation. As Sustainalytics noted, scandals like this led to “unprecedented termination of business relationships” for KPMG and others, underscoring how vital auditor independence is.
- Define Scope with Care and Verify Allegations: Rather than accepting prior reports as a basis, the KPMG team should have scoped the engagement to independently verify each claim about the unit’s activities, even if that meant broadening the investigation. A clear term of reference should have been: find out what the unit did, was it lawful, and who knew about it, with no presumption of guilt. By not properly defining this neutral scope, the investigation fell into confirmation bias. The lesson is to avoid framing an investigation to “get a particular answer.” Instead, approach with an open mind and a plan to gather evidence before reaching conclusions.
- Document and Substantiate Everything: Had KPMG compiled strong, admissible evidence for each of its findings, it could have stood by its report. The retraction indicates that the evidentiary basis was weak or undocumented. Future investigations must therefore leave a clear audit trail. If something as severe as “unlawful spying” is alleged, the evidence (emails ordering it, devices used, testimonies, etc.) must be gathered and preserved. If evidence is lacking, the report must reflect that uncertainty rather than assert conclusions. Transparency in documentation also means if KPMG had cited the sources (like prior reports) clearly, peers could have seen the overlap and potential issues earlier – reminding that proper citation and attribution in reports matters.
- Follow Due Process: The SARS case highlights that not interviewing key individuals was a grave misstep. Even if not legally required in a fact-finding report, basic fairness and thoroughness dictate hearing from those accused. The lesson: always consider including the perspective of those under investigation, or at minimum, ensure the report stays factual and avoids definitive blame if no opportunity to respond was given. Engaging an outside legal advisor to review the investigation process for fairness might have caught this issue in time.
- Manage Stakeholder Expectations and Communication: Another takeaway is the importance of how findings are handled. SARS publicly trumpeted the KPMG report’s findings, which later blew up in their face. A more prudent approach would have been handling such allegations more quietly until a robust outcome was obtained. Organisations should be careful about how they communicate interim or unproven findings from forensic audits to avoid reputational self-harm.
In conclusion, the SARS “rogue unit” saga encapsulates many of the don’ts of forensic auditing. It reinforces why the principles of independence, proper scoping, evidence diligence, and legal fairness are not mere box-ticking exercises but essential to uncovering truth and maintaining credibility. The cost of neglecting these principles was huge for KPMG and SARS – a lesson that echoes for all companies in South Africa and beyond.
How to Avoid Forensic Audit Pitfalls: Best Practices and Recommendations
Having examined where forensic audits can go wrong, we now turn to how organisations can get them right. The following best practices correspond to the common mistakes discussed, offering a roadmap to avoid each pitfall. These recommendations draw on insights from leading forensic practitioners (including PwC, Deloitte, KPMG, and EY) and are geared towards corporate clients in South Africa looking to strengthen their forensic audit processes.
5.1 Define a Clear Scope and Plan
“Begin with the end in mind” is an apt mantra for forensic audits. Start by clearly defining the purpose and scope of the investigation. This includes:
- Establish Specific Objectives: Pinpoint the questions the audit must answer (e.g., “Was Supplier X involved in kickbacks with any employee?” or “Quantify the loss from the identified fraud scheme in the last 3 years”). Avoid vague goals. Writing a one-page scope statement or Terms of Reference that all stakeholders agree on is invaluable.
- Set Boundaries and Priorities: Determine the relevant period, business units, transactions, and systems to be examined. If new leads emerge, formally adjust the scope with stakeholder agreement to control scope creep. Prioritise critical issues so that if resources constrain, the most important questions are resolved first.
- Assemble the Right Team and Skills: A plan should list the expertise needed – accounting, legal, IT forensics, etc. If internal capacity is lacking, plan to bring in external specialists or one of the Big Four forensic teams. Ensure team members are briefed on the scope and their roles.
- Plan the Timeline and Milestones: While investigations can be unpredictable, set a rough timeline with milestones (e.g., evidence collection phase, analysis phase, report draft by X date). This keeps momentum and allows progress tracking. Communicate to management that quality is paramount – rushing to meet an arbitrary deadline can be counterproductive if it compromises thoroughness.
- Perform an Initial Risk Assessment: At the outset, identify any immediate actions needed (for example, to secure certain records or to prevent further harm). As KPMG advises, asking preliminary questions about the basis of suspicions, potential damage, and legal infringements will guide the urgency and depth of the plan. If a large fraud is possible, the plan might include involving law enforcement early, whereas a smaller internal matter might not.
Document the investigation plan and get it approved by whoever commissioned the audit (e.g., Audit Committee or senior management). This ensures alignment and provides a reference if disputes on scope arise later. Remember, a well-defined scope keeps the team focused and efficient, helping avoid wasted effort and missed areas.
5.2 Ensure Independence and Expertise
The integrity of a forensic audit rests largely on the people conducting it. Therefore:
- Select Independent Investigators: Choose a team that has no stake in the outcome and no conflicts of interest. If the matter involves senior management, consider engaging an external firm to avoid internal pressure. Insist on transparency – investigators should disclose any past relationships that could pose a conflict. It might be necessary, for instance, to avoid using the company’s regular audit firm if their objectivity could be questioned, and instead hire another firm or an independent specialist.
- Governance Oversight: Have the investigation report to an impartial body such as the Audit Committee or a special committee of the board, rather than to management who might be involved in the issues. This provides a buffer against undue influence and underscores independence. Many South African companies, mindful of recent scandals, now ensure forensic investigations of executives report directly to the board or even an external legal counsel to maintain credibility.
- Adhere to Ethical Standards: Investigators should follow professional codes (ACFE, SAICA, ICFP etc.). As a guideline, they must conduct examinations that are fair and unbiased, and avoid any cases where they have a conflict. Emphasise to the team that their role is fact-finding, not advocacy. Avoid language in communications or reports that suggests prejudice.
- Engage Qualified and Trained Personnel: Ensure the individuals have proper forensic training. As Duja Consulting has highlighted, “auditors who are not adequately trained may miss critical evidence, fail to identify fraud patterns or draw incorrect conclusions”, compromising the audit’s quality. Look for certifications like CFE (Certified Fraud Examiner) or forensic accounting credentials, and practical experience in similar cases. If the investigation involves IT systems, include certified digital forensic examiners.
- Ongoing Training: For internal forensic teams, invest in continuous training to keep skills sharp and updated on new fraud schemes. In the long run, this mitigates the risk of errors. In a field that evolves with technology and criminal tactics, learning never stops.
By ensuring independence and competence, the investigation’s findings will command respect. Companies might take a cue from the public sector which now often demands that forensic auditors be members of bodies like ACFE/ICFP – private firms too can set similar expectations for anyone they hire. Remember, independent experts are more likely to deliver bad news honestly, which is exactly what you need to effectively address problems.
5.3 Document Evidence Meticulously
Discipline in documentation can make or break the success of a forensic audit. Key recommendations include:
- Implement Chain of Custody Procedures: From the moment evidence is collected, log it. Use a standard form or system to record what was collected, when, where, from whom, and who handled it subsequently. For digital evidence, keep checksums or hash values as proof of integrity. Never allow gaps – evidence should be under control at all times. For instance, if copying data from a server, document the process and secure the copy. As KPMG notes, “if the chain of custody is not maintained, evidence may be deemed inadmissible,” so treat every item as if it will later be challenged.
- Maintain an Investigation File: All work product – interview notes, documents, analysis spreadsheets, email correspondence – should be organised in a central file or repository. This can be electronic (with proper access security) and mirrored with a physical file for critical original documents. Number or index the evidence so that you can reference it easily in the report (e.g., Exhibit 1, Exhibit 2…). This organisation will help when reviewing progress and during any external scrutiny.
- Record Interviews and Obtain Statements: For each interview, have at least two people present (if possible) and take detailed notes. After the interview, prepare a summary or transcript and request the interviewee to confirm its accuracy (signing it if feasible). This not only preserves their testimony but also can be used to refresh memories or confront inconsistencies later. In sensitive cases, consider audio-recording interviews (with consent and legal advice) to ensure exact capture of words.
- Document Analytical Procedures: If you perform data analysis (e.g., identifying 20 suspicious transactions out of 10,000), document the steps – which data sources, what criteria used (keywords, thresholds), and the results. Save the outputs (printouts, screenshots or files) as evidence. This allows someone else to replicate your work if needed. It also proves that the identified anomalies are not just conjecture but backed by systematic analysis.
- Keep a Log of Findings and Decisions: As the investigation progresses, maintain a log of significant findings and decisions (e.g., “On June 10, decided to expand scope to include 2018 records after finding evidence of earlier fraud”). This creates a timeline of the investigation. It can be helpful later for writing the report and for any questions about why certain steps were taken.
- Secure Evidence Properly: Store physical evidence (paper files, devices, etc.) in a secure, access-controlled location (like a locked cabinet or evidence room). For digital evidence, use encrypted storage. Limit who can access evidence to maintain integrity. Document whenever evidence is checked out or transferred.
Thorough documentation pays dividends: it strengthens the credibility of the findings, aids in report writing, and protects against challenges. It ensures that if you assert something in your report, you can immediately back it up with “Exhibit X”. This level of rigour is what courts and stakeholders expect of a professional forensic audit. In practice, adopting a checklist or standard operating procedure for evidence management (often available from professional bodies) can enforce consistency.
Navigating the legal landscape is crucial for a forensic audit. Companies should take the following steps to ensure compliance and fairness:
- Consult Legal Counsel Early: Involve the company’s legal advisors at the planning stage. They can advise on employment law issues, privacy concerns, and any reporting obligations. For instance, if the investigation might lead to criminal charges, legal counsel can guide on working with law enforcement or obtaining necessary warrants for certain information. Having legal guidance helps avoid missteps that could later invalidate the process.
- Respect Employee and Individual Rights: Even if someone is suspected of wrongdoing, they have rights. In South Africa, labour law and constitutional rights mean you cannot simply trample privacy or due process. Ensure any search of personal workspaces, devices, or communications is done lawfully (e.g., with proper authorization and witness present). If you suspend an employee for the investigation’s duration, follow the contractual or statutory procedure for suspension. When making findings that could harm someone’s reputation, consider giving them a chance to respond (a written representation or interview) before finalising those findings, unless doing so would jeopardise evidence. This makes the process fairer and the report more robust against claims of bias.
- Follow Regulatory Protocols: If you are in a regulated industry (banking, insurance, etc.), be aware of any requirements to report certain incidents to authorities (like the Prudential Authority or FSCA). Also, if the forensic audit uncovers evidence of crimes such as fraud, corruption, theft over statutory thresholds, there may be a duty to report these to the police under laws like PCCAA. Build these compliance steps into the investigation plan – for example, decide at what point, if any, law enforcement is notified or involved.
- Ensure Procedural Fairness: If the investigation’s outcome will be used for disciplinary action, align with the Labour Relations Act provisions. That might mean keeping evidence confidential until a formal disciplinary hearing where the accused can hear and challenge it. Don’t ambush employees with public accusations via the forensic report. The Masuku and Maru judgments in SA emphasise that where an investigative report effectively decides someone’s fate, it can be reviewable for fairness. Thus, structure your process to be as fair as possible (without compromising the investigation). This could involve conducting “predisciplinary” interviews or at least phrasing findings conditionally when input wasn’t obtained.
- Avoid Overstepping Mandate Legally: Know the legal powers (or lack thereof) of your investigators. They are not the police – they can’t subpoena external third-party records without consent, for example. If something requires a power your team doesn’t have (like phone records or bank statements), you may need to coordinate with authorities or get creative within legal bounds (e.g., obtain consent from a willing witness). Acting beyond legal authority (like seizing private property without permission) can lead to lawsuits and evidence being thrown out. As a guideline, always ask: “Can we lawfully do this and how do we prove it was lawful?” If unsure, pause and get legal advice.
- Ethical Conduct: Maintain confidentiality throughout the process. Leaking investigation details can not only defame individuals prematurely but also violate laws (and it’s unethical). Only communicate on a need-to-know basis internally. Externally, any public statements should be carefully vetted. In the SARS case, publicizing unproven accusations caused huge harm – a lesson in restraint. Furthermore, treat everyone with professionalism; intimidation or deceitful tactics can backfire and breach ethical codes. An investigation can be assertive but still respectful of the dignity of those involved.
By embedding legal compliance into the DNA of the forensic audit, an organisation not only protects itself from future legal challenges but also upholds a reputation for integrity. This aligns with the notion of the rule of law: even the process of catching wrongdoers must itself be lawful and just. A well-handled investigation in this regard will stand up under any external review, and its outcomes (be it dismissals, criminal cases, or recovery actions) will have a far better chance of success.
5.5 Leverage Technology and Data Analytics
Maximising the use of technology will significantly enhance the effectiveness of a forensic audit. Here’s how to do it:
- Use Data Analytics to Detect Anomalies: Employ specialised software (IDEA, ACL, Power BI, or Python/R for custom analysis) to crunch through financial and operational data. For example, run keyword searches on descriptions for terms like “gift” or “consulting” that might hide bribes, use Benford’s Law analysis on payments data to spot unnatural number distributions, or run duplicate testing to catch double billing. Data analytics can quickly highlight suspicious transactions or trends that merit closer human review. Many of the Big Four offer forensic data analytics as part of their service, reflecting how critical it is. Mandating the use of data analytics in fraud risk testing is even something firms like EY have implemented in audits of listed companies.
- Deploy E-discovery Tools for Documents and Communications: When dealing with email or large document sets, use e-discovery platforms (e.g., Relativity, Nuix, or even Microsoft’s built-in e-discovery if using Office 365). These allow you to filter by date ranges, correspondents, and keywords, and to perform advanced analysis like communication mapping. They also help ensure you collect all relevant data (and not accidentally alter it). Early Case Assessment (ECA) tools can give an overview of data before deep diving. For instance, Brainspace, as noted, can reveal themes and clusters in emails that guide investigators to areas of interest. Without such tools, one could literally drown in information or miss critical evidence scattered in the noise.
- Incorporate Digital Forensics: If there’s any indication of electronic evidence (which is almost always the case), involve digital forensics specialists. They can image computers and phones in a way that preserves all data (including deleted files, metadata, etc.) and then use tools to retrieve and analyse that data. For example, recovering deleted WhatsApp chats or examining USB drive usage logs can crack a case. Ensure that any analysis on digital devices is done on copies (forensically imaged) so the original is not altered – a practice that stands up in court as proper handling. Also, be aware of new data sources: cloud storage, social media, CCTV footage – technology touches everything and shouldn’t be ignored.
- Visualise and Link Data: Consider using visual analytics for complex relationships – link analysis software can create graphs of connections between people, entities, bank accounts, and so on. This helps identify if, for instance, an employee’s spouse is the owner of a vendor company receiving payments (a conflict of interest that might signal fraud). Graphs and charts can also be powerful in explaining findings to non-technical stakeholders in the final report.
- Stay Updated on Emerging Tech: Encourage your team to stay abreast of new tools, such as AI and machine learning, which are increasingly used to detect patterns humans might miss. While not every investigation needs cutting-edge AI, being aware of its capabilities (like anomaly detection algorithms, or AI-assisted document review) can give you an edge in particularly challenging cases.
- Plan for Technology in Budget: Often, the cost or complexity of tools can be a barrier. Plan and budget for necessary software licenses or specialist fees in advance as part of the investigation scope. It is cheaper in the long run to invest in technology upfront than to miss something major and face the fallout. Many providers have scalable solutions, and some analytics can even be done with open-source tools by those with the right skills.
Embracing technology ensures that the forensic audit is thorough and efficient. As Deloitte’s insights imply, combining human intuition with artificial intelligence and analytics is the future of combating fraud. Human expertise remains vital to interpret results, but those humans should be equipped with the best tools available. By leveraging technology, companies can level the playing field against tech-savvy fraudsters and handle the ever-growing volumes of data involved in today’s business operations.
Conclusion
Forensic audits are a powerful mechanism for South African companies to uncover the truth, enforce accountability, and ultimately foster a culture of integrity. When executed correctly, a forensic investigation can expose complex fraud schemes, provide actionable evidence for recovery or prosecution, and reinforce stakeholders’ confidence that wrongdoing will be dealt with decisively. However, as this white paper has detailed, there are common mistakes that can derail even the most well-intentioned forensic audit. Poor scoping can misdirect efforts; lack of independence can taint credibility; insufficient documentation can weaken evidence; procedural missteps can invalidate findings; and lagging on technology can leave critical insights undiscovered.
The repercussions of these errors are not abstract – they have been vividly demonstrated in the South African corporate landscape, from protracted court battles over flawed reports to severe reputational and financial damage for firms that got it wrong. The case study of the SARS “rogue unit” investigation underscored how a convergence of multiple mistakes led to a failed outcome with broad fallout. It serves as a cautionary tale that forensic audits must adhere to the highest standards of professionalism.
Encouragingly, each pitfall comes with a corresponding set of best practices to avert it. By clearly defining the scope and maintaining focus, ensuring investigators are impartial and properly skilled, rigorously preserving and documenting evidence, following the rule of law and fair process, and harnessing modern analytical tools, organisations can significantly enhance the success of forensic audits. These steps are not merely theoretical ideals; they are drawn from the hard-earned wisdom of industry leaders and global consulting firms that have shaped forensic practice over decades. Firms like PwC, Deloitte, KPMG, and EY consistently advocate for these principles – and often assist clients in implementing them – because they have seen their effectiveness in delivering robust results.
For corporate clients in South Africa, the message is clear: investing in doing forensic audits right is an investment in the organisation’s own resilience and credibility. In a country where economic crime is high but stakeholder tolerance for negligence is low, companies must approach forensic investigations with rigour and integrity. This not only avoids the direct consequences of mistakes but also sends a positive signal to employees, investors, and regulators that the company is committed to good governance.
In conclusion, forensic audits, when free of common mistakes, serve as a potent guardian of corporate integrity. They help ensure that no matter how artful the fraud or misconduct, it can be detected and addressed. By learning from past errors and embracing best practices, organisations can turn forensic audits into a formidable defense against corruption and fraud – a way to not just react to incidents, but to reinforce a culture where ethical behaviour is the norm and malfeasance is swiftly uncovered and dealt with. In doing so, businesses protect not only their bottom line, but their reputation and licence to operate in the eyes of the South African public. The old adage holds true: prevention is better than cure, but when prevention fails, a well-conducted forensic audit is the cure to set things right. Adhering to the guidance outlined in this paper will help ensure that cure is effective, credible, and stands the test of scrutiny.
Sources
- PricewaterhouseCoopers (2018). Global Economic Crime and Fraud Survey – South Africa. PwC Press Release, 27 Feb 2018.
- AKGVG & Associates (2023). Forensic auditing in corporate governance. [Blog Post].
- KPMG (2019). Investigation dos and don’ts – Fraud Intelligence Magazine, Dec 2019/Jan 2020.
- Sekgalo Tsaagane (2025). The Blindspot in Investigative Findings: Lessons from South African Case Law. MBA Incorporated, Thought Leadership article.
- Accountancy Age (2017). KPMG rocked by South African corruption scandal, 27 Sep 2017.
- Duja Consulting (2024). The Overlooked Risks of Inadequate Training in Forensic Auditing. [Blog Post].
- Deloitte (2020). The evolution of forensic reviews. [Insight Article].
- EY (2020). Preventing and detecting fraud: strengthening the roles of companies, auditors and regulators. EY Global Assurance perspective.
- PwC (2024). Global Economic Crime and Fraud Survey 2024. PwC Global report (cited for statistics on fraud prevalence).
- Various sources on South African legal cases: Msiza v Prudential Authority and Maru v MEC for Transport (2023–2025) as discussed in MBA Inc. article.
