Forensic Fraud Detection and Automated Framework

portfolio info

  • Date

    July 8, 2026

Forensic Ratio Analysis & Fraud Detection

Forensic Fraud Detection & Automated Detection Framework

A forensic ratio analysis that identifies six converging earnings-manipulation red flags in a SaaS company case study, paired with a proposed five-stage automated fraud detection architecture.

Forensic Ratio Analysis Beneish M-Score COSO Controls Fraud Detection Systems
A note on sourcing: This is a self-initiated forensic analysis. I applied forensic accounting and ratio-analysis skills I developed during my Master of Accounting in Forensic Analysis. The subject company, Maxwell Tech Solutions Ltd., is a fictional case study used to demonstrate methodology; the ratios and red-flag findings are calculated from that case study’s financial data.

Why this analysis

Maxwell Tech Solutions Ltd., the SaaS company case study, showed three years of steady reported revenue growth alongside whistleblower-style concerns about the quality of that reporting. The goal here was to apply forensic ratio analysis and see whether the underlying financial trends actually supported the reported growth story or contradicted it, then propose a systematic, automated framework for catching this kind of pattern earlier in a real organization.

Six converging red flags

Accounts Receivable Turnover fell from 12.0x to 5.4x over three years while Days Sales Outstanding more than doubled. Collections were slowing sharply even as reported revenue grew, which is a classic sign of aggressive or premature revenue recognition.

AR Turnover decline vs DSO increase chart, 2022-2024
Exhibit B-1: AR Turnover Decline vs. DSO Increase, 2022-2024.

Gross margin sat at 40 to 44% throughout the period, far below the 70 to 85% typical of mature SaaS businesses, while net margin drifted down even as revenue nearly tripled. That’s not consistent with the operating leverage a scaling SaaS company should show.

Gross and net margin chart vs SaaS benchmark, 2022-2024
Exhibit B-2: Gross & Net Margins vs. SaaS Benchmark, 2022-2024.

The most serious signal is that Operating Cash Flow fell even as Net Income rose. The OCF-to-Net-Income ratio collapsed from 97.5% to 17.6% over three years, meaning earnings were increasingly disconnected from actual cash collection. Of everything in this dataset, this is the strongest single indicator of potential earnings manipulation.

Operating cash flow vs net income chart, 2022-2024
Exhibit B-3: Operating Cash Flow vs. Net Income, 2022-2024.
5.4x
AR Turnover, 2024, down from 12.0x in 2022
67.6d
Days Sales Outstanding, 2024, up from 30.4 days
17.6%
OCF/Net Income, 2024, down from 97.5%

Beneish M-Score components

The original analysis referenced the Beneish M-Score model conceptually but never actually calculated it. Five of the model’s eight standard variables can be computed directly from the available data. The remaining three (AQI, DEPI, SGAI) require PP&E, depreciation, and SG&A detail that isn’t present in this dataset, so instead of a single blended M-Score, only the components that can be honestly calculated are shown below.

DSRI
Days Sales in Receivables Index
1.60 (2023) / 1.39 (2024)

Above 1.0 both years, receivables growing faster than sales.

GMI
Gross Margin Index
1.00 (2023) / 0.90 (2024)

Near/below 1.0, margin did not deteriorate, a mixed signal.

SGI
Sales Growth Index
1.50 (2023) / 1.50 (2024)

Elevated growth, consistent with revenue-recognition risk.

TATA
Total Accruals to Total Assets
0.048 (2023) / 0.088 (2024)

Rising positive accruals, an earnings-quality red flag.

LVGI
Leverage Index
1.04 (2023) / 1.10 (2024)

Rising, leverage increasing faster than the prior year.

5 of 8 standard M-Score variables are computable from the data provided. AQI, DEPI, and SGAI require PP&E, depreciation, and SG&A detail not available in this dataset, so no single blended M-Score is presented.

Four of the five computable components point the same direction: rising receivables relative to sales (DSRI), elevated revenue growth (SGI), rising positive accruals (TATA), and rising leverage (LVGI) are all consistent with the qualitative red flags identified above. That gives the finding a second, independent layer of quantitative support.

Proposed automated detection architecture

Beyond identifying the red flags after the fact, this project proposes a five-stage system for catching this kind of pattern earlier and continuously, rather than only during year-end review.

STAGE 1 Data Ingestion ERP, GL, sub-ledgers, XBRL / MD&A feeds STAGE 2 Control Checks COSO-aligned: approvals, segregation, reconciliation STAGE 3 Ratio Red-Flags AR turnover, DSO, margins, OCF/NI vs. thresholds STAGE 4 Predictive Modeling Logistic Regression, Random Forest scoring STAGE 5 Alerting & Forensic Reporting Alerts and confirmed findings feed back into control-threshold tuning for the next detection cycle. Five-stage architecture as proposed for Maxwell Tech Solutions Ltd., from data through to forensic alerting.
Five-stage automated fraud detection framework, data ingestion through forensic alerting.

Data flows from ERP, general ledger, and external filings (XBRL/MD&A) into COSO-aligned control checks, then through automated ratio-based red-flag detection, predictive modeling (Logistic Regression and Random Forest scoring), and finally into forensic alerting. Confirmed findings then feed back into threshold tuning for the next detection cycle.

Key achievements

  • Identified six converging forensic red flags across receivables, margin, and cash-flow-quality dimensions in a three-year dataset
  • Quantified the AR Turnover collapse (12.0x to 5.4x) and OCF/Net Income deterioration (97.5% to 17.6%) as the two strongest signals in the dataset
  • Computed 5 of 8 Beneish M-Score components directly from the underlying data, independently backing up the qualitative findings
  • Designed a 5-stage automated fraud detection framework spanning data ingestion, internal controls, ratio-based detection, machine learning, and forensic alerting
  • Built the system architecture diagram that was missing from the original written analysis, closing a real gap between the proposed framework and its documentation

Technologies & methods used

Google Sheets Forensic ratio analysis Beneish M-Score COSO Internal Control Framework Fraud detection system design

Explore the analysis

The Exhibit Case Brief plus the full written documentation behind this analysis.