Forensic Accounting and Fraud Investigation in Dubai

A forensic engagement produces a written report, and the shape of that report is settled at the start rather than at the end. It sets out the question put to the expert, the documents and records examined and where each came from, the method applied to them, the analysis, and the findings with the reasoning that supports each one. Anything the expert could not test, and any record that was unavailable or incomplete, is stated rather than left implicit, because a gap that is disclosed is easier to defend than a gap a reader discovers.

Where the report is intended for proceedings, its structure follows what the Evidence Law expects of expert work under Part 10, Articles 109 to 125: the task, the parties' statements, the documents relied on, the technical analysis, and reasoned findings, with any dissent recorded. A report written to that shape for an internal purpose remains usable if the matter later reaches a court. A report written loosely for internal purposes often has to be redone.

The schedules carry the arithmetic. The narrative should be readable by a lawyer or a director without a calculator, with each figure traceable to a schedule and each schedule traceable to source documents. For how a reader works through one, see the article on how to read a financial expert report.

The same findings serve two purposes and are read by two audiences. Inside the business they answer what happened, how it was possible, and which control failed, and they support decisions on recovery, insurance, employment and disclosure. Before a court they are evidence, and their weight depends on how they were obtained and recorded as much as on what they show.

Where a matter proceeds criminally, embezzlement of movable property entrusted to a person is dealt with as breach of trust under the Penal Code, Federal Decree-Law 31 of 2021, Article 453. Where it proceeds civilly, the same analysis supports a claim expressed in figures. Where it proceeds in arbitration, a tribunal may appoint its own expert under Federal Law 6 of 2018, Article 34, and a report that is clear about its method tends to shorten that step rather than duplicate it.

Which route to take is a legal decision, taken with counsel. What the forensic work can do is put that decision on figures that have been tested, rather than on an estimate formed early and defended afterwards.

Most of what a forensic engagement examines now sits in accounting systems, email and messaging, and the Evidence Law addresses electronic records and evidence and their probative value in Articles 53 to 63. Handling matters: a ledger extracted with its audit trail, a mailbox exported in a form that preserves headers and dates, and a record of who took each copy and when, carry more weight than the same content gathered informally.

Where a document is held by the other side, a party may ask the court to order its production under the Evidence Law, Articles 33 and 34, and a refusal can mean the applicant's copy is taken as true or its description accepted. In commercial cases, Article 35 of the Evidence Law allows a refusal to be treated as a presumption that the claim is true. Where the holder is a third party or a public body, Article 36 of the Evidence Law allows the court to order production of documents or information.

Two consequences follow. Preservation comes before analysis, so access should be secured and copies taken before anyone is alerted and before systems are tidied in the ordinary course. And the reason a record is missing should be noted at the time, because the difference between a document that was never created and one that was removed is often the point on which a matter turns.

Timelines follow scope and record quality rather than the calendar. A narrow question over a single account and a defined period, with complete records supplied at the start, is usually a matter of weeks. A wider mandate across several entities, multiple years, related party flows and books that have to be reconstructed runs to months, and the reconstruction is usually the longest part of it.

Three things move the date more than the analysis does. Bank confirmations and third party records are requested from institutions that set their own turnaround. Records held by a party who is the subject of the work rarely arrive quickly, which is where the production route under the Evidence Law, Articles 33 to 36, becomes relevant. And a scope that widens mid engagement resets the schedule, so it is generally better to define the question narrowly, answer it, and extend deliberately than to start broad.

Where proceedings are already on foot, the court's own timetable governs and the engagement is planned backwards from it. Where they are not, the constraint is usually evidence decay rather than any deadline, and that argues for starting sooner.

The first meeting is more useful with a few things in hand: a short written account of what is suspected and how it came to light, with dates; the period the concern covers; the entities and accounts involved; and the roles, rather than the individuals, that had access to the records and to the funds.

On the records side: the trial balance and general ledger for the period, bank statements for every account, the accounting system and who administers it, the approval and payment authorities as they actually operated rather than as the manual describes them, and any internal review already carried out. Where an internal review has been done, its working papers matter as much as its conclusion.

Two cautions. Confronting a suspected individual before evidence is secured tends to cost more than it gains. And an engagement instructed through counsel may attract protections that a direct instruction does not, which is a question to settle with a lawyer before work starts rather than after. For what the work looks like once it is running, see what happens during a forensic audit.