In recent years, many organisations have invested in Information Technology to enhance service delivery, improve business processes and increase profitability (McKinsey 2020). This digital transformation has resulted in the exponential growth of electronic data, which, while enabling efficiency, has also introduced complexities that expose organisations to fraud and cybercrime (Putra et al. 2022; Vera-Baquero & Colomo-Palacios 2013). As fraudsters exploit technological vulnerabilities, auditors are increasingly required to be proficient in advanced audit technologies to safeguard organisational data and integrity (Eulerich et al. 2023).

Computer-aided audit techniques and tools (CAATs) were developed to assist auditors in extracting, testing and interpreting computer-generated data. Common CAATs include generalised audit software, expert systems, utility software, test data and application tracing and mapping (Global Technology Audit Guide [GTAG] 2009; Lambrechts et al. 2011). More recently, data analytics has extended the functionality of CAATs by enabling auditors to design procedures that detect fraud, misstatements and errors in financial information (Suyts, Shadrin & Leonov 2017). This development reflects the growing need for fraud-prevention mechanisms that protect not only profitability but also business continuity, economic stability and social responsibility (Isa & Chakraborty 2022; Samagaio & Diogo 2022).

The Association of Certified Fraud Examiners (ACFE) reported that in 2018, 63% of fraud concealment involved manipulation of physical and electronic data, rising to 76% in 2020 (ACFE 2018a, 2018b, 2020). By 2022, electronic evidence concealment had become the most common method used by fraudsters, often exploiting emerging technologies such as blockchain (ACFE 2022). Similarly, PricewaterhouseCoopers (PwC) found that 53% of organisations reported financial losses resulting from fraud, primarily driven by external offenders exploiting weak internal processes (PwC 2022). Empirical evidence underscores the scale of the challenge posed by fraud and economic crime (EC).

Fraud detection remains inherently complex because perpetrators deliberately manipulate systems to conceal their actions, departing from expected behaviour (Pacini et al. 2019). Traditional audit methods often fail to detect such anomalies, particularly in organisations with complex structures and large volumes of data (Brahimi & Elhussein 2023; Cybersource 2021). Scholars highlight challenges such as incomplete records, undersampling and evolving fraudulent patterns that complicate detection (Seify et al. 2022; West & Bhattacharya 2016a). At the same time, data analytics has demonstrated its ability to uncover hidden patterns and anomalies, offering auditors a more reliable basis for fraud detection in computerised environments (Sawangarreerak & Thanathamathee 2021).

The literature review moves from the respective roles of auditors in fraud detection to technology-enabled fraud, analytical tools and anomaly-detection challenges that motivate the use of FDA in practice. Internal, external and forensic auditors play complementary roles in fraud detection and prevention. Vanasco, Skousen and Verschoor (1995) argue that external auditors provide an independent evaluation of financial statements to assure stakeholders of their accuracy and the absence of material misstatement. According to the Institute of Internal Auditors (IIA 2016), internal auditors focus on the effectiveness of internal controls and risk management through continuous monitoring. Forensic auditors intervene when fraud is suspected or detected, conducting investigations to determine the extent of activities and gather evidence for legal proceedings (Olaoye & Olanipekun 2018).

Fraud is defined as intentional misrepresentation resulting in actual or potential prejudice (the Southern African Legal Information Institute [SAFLII] 2007; Snyman 2002). High-profile cases such as Steinhoff International and Venda Building Society (VBS) Mutual Bank illustrate the evolving and often systemic nature of fraud in South Africa (Van Wyk 2020). The fraud triangle opportunity, pressure and rationalisation offer a useful framework for understanding the motivations underlying fraudulent behaviour (Tickner & Button 2021). As electronic data volumes continue to grow, traditional auditing methods based on sampling and manual review are increasingly inadequate for detecting complex and technology-enabled fraud (Rakipi, De Santis & D’Onza 2020; Zhu et al. 2021).

Ikhsan et al. (2022) assert that, unlike traditional fraud, technology-enabled fraud can be perpetrated remotely and may be more difficult to trace to perpetrators. Generalised audit software plays a central role in modern auditing. Tools such as Audit Command Language and Interactive Data Extraction and Analysis enable auditors to import, consolidate and analyse large datasets from organisational systems and spreadsheets (Boritz & Datardina 2007; Widuri, Handoko & Riantono 2019). Other tools, including Microsoft Excel and Power BI, support data visualisation, dashboard development and the communication of findings (Doko & Miskovski 2020; Nigrini 2020). This study does not seek to review all fraud theories or all CAATs; instead, it focuses on the applications and techniques through which data analytics supports fraud detection.

Runkler (2012:2) defines data analytics as: ‘the application of computer systems to the analysis of large data sets for the support of decisions’. Auditors employ analytics to process entire data populations, identify anomalies and visualise suspicious patterns (Information Systems Audit and Control Association [ISACA] 2011; West & Bhattacharya 2016b). Data analysis has emerged as a predominant activity in forensic auditing, enabling auditors to identify fraud within electronic data. However, its effectiveness can be undermined by technology-related risks, including changes in business processes, collusion, data breaches and cybercrimes. Despite being transaction based, the data analysis process contributes significant value by offering recommendations that enhance clients’ control effectiveness and highlight vulnerabilities to fraud and corruption (Smidt 2016).

The role of data analytics in detecting fraud and irregularities is indispensable. Data analytics provides the auditor with the ability to run automated procedures and analyse the full data population (Bierstaker, Janvrin & Lowe 2013). Its role extends beyond fraud detection to include risk assessment, continuous monitoring and strengthening internal controls (GTAG 2009). The primary objective of data analytics is to uncover anomalies and patterns in datasets that may indicate misconduct, thereby identifying warning signs and suspicious markers that help prevent illicit activities (Nejad, Khan & Othman 2024). The process encompasses data collection, cleansing and detailed examination to identify anomalies or behavioural patterns associated with fraud (Stripling et al. 2018). By applying analytical techniques, auditors can move from descriptive analysis of past events to predictive modelling of potential fraud risks (Rakipi et al. 2020).

While various tools exist, many do not provide straightforward rules for fraud detection and instead require specialised skills and knowledge to be applied effectively (Alexiou 2016). Data analytics in forensic auditing is inherently explorative and investigative, aiming to produce documented findings, conclusions and recommendations. Moreover, the process often involves the use of targeted analytic queries designed to generate purposeful audit reports based on identified anomalies and patterns (Lambrechts et al. 2011). Data analytics software supports functions such as sampling, stratification, Benford’s Law analysis and the automation of repetitive tasks, thereby enhancing efficiency and precision in fraud detection (Motubatse et al. 2015).

Fraud detection can be understood as the application of forensic auditing tools and techniques to uncover fraudulent activities. Because fraudulent schemes are often concealed through collusion, process manipulation and control override, detection requires both technical expertise and a strong understanding of how fraud is perpetrated and concealed (Bakri, Mohamed & Said 2017; Bello et al. 2023).

Kerler and Killough (2009) emphasise that the complexity of fraud detection necessitates the exercise of professional scepticism when evaluating evidence during forensic audits. Such complexity often arises from collusion among employees, manipulation of operational processes and management’s ability to override internal controls (ACFE 2020). These factors significantly hinder detection, as perpetrators may actively conceal their actions and destroy evidence to avoid exposure (Villaescusa & Amat 2022).

The expansion of data analytics is linked to the growth of data volume and the increasing complexity of fraudulent schemes (Zhou et al. 2020). One key challenge is the detection of anomalies in large and heterogeneous datasets, as inconsistencies, missing values and deliberate manipulation can obscure fraudulent behaviour. Both structured and unstructured data can contain anomalies, rendering manual detection and traditional audit procedures inadequate in complex environments (West & Bhattacharya 2016a).

Patterns of anomalies may change as business processes evolve and transaction volumes increase, which complicates fraud detection. Common manifestations include additions, removals and unauthorised changes in data and events (Motie & Raahemi 2024; Saha et al. 2023). In response, scholars advocate combining supervised and unsupervised analytical methods to strengthen the identification of both known and previously undetected fraud patterns. The broader implication is that big-data environments require more advanced and adaptable analytical approaches.

Forensic auditors rely on data as evidence, which means that relevant data must be accessible, available and preserved in a manner that protects its integrity (Renner-Micah, Effah & Boateng 2023; Wiesmüller & Bauer 2023). In high-risk datasets, effective fraud detection often depends on reconstructing transactions, profiling patterns and applying analytical procedures that distinguish normal from abnormal behaviour (Gresoi et al. 2023). This reinforces the growing convergence between FDA and computer forensics in contemporary fraud investigations.

The study followed a systematic empirical research design, which provided a structured framework for uncovering insights into fraud detection through FDA. As Creswell (2009) emphasises, research design offers control over variables that may affect validity, while empirical approaches remain grounded in direct observation and evidence (Wangrow, Schepker & Barker 2015). This orientation ensured rigour and reliability, allowing the researcher to investigate fraud-detection practices in a real-world organisational context.

This study adopts an explanatory single-case study design to enable an in-depth examination of how data analytics are operationalised in fraud detection within a complex organisational environment. Consistent with prior methodological literature, single cases are particularly appropriate where the phenomenon is context dependent, access to fraud data is restricted, and the objective is theory development rather than statistical generalisation. The petroleum sector represents an information-rich context for examining fraud analytics because of its high transaction volumes, complex supply chains and elevated exposure to procurement and revenue-related fraud risks. The unit of analysis in this study is not the organisation itself, but the application of data analytics to specific fraud risk scenarios across key business cycles.

The study employed both primary and secondary data sources. Primary data comprised internal organisational documents relating to 23 forensic audit engagements in which data analytics had been applied. These documents included forensic audit reports, policies and procedures, file notes and working papers. Secondary sources comprised academic literature, journal articles and professional publications. Because the primary material was not publicly available, document analysis was used to examine how FDA tools were embedded in organisational processes and interpreted by practitioners (Wood 2020). The literature review complemented this analysis by establishing the theoretical foundation and informing the research questions, thereby supporting triangulation as reflected in Table 1.

Content analysis was used to examine the documentary evidence. It enabled the researcher to extract, organise and interpret meaning across documents of different types (Elo et al. 2014). Thematic analysis was then applied to identify patterns across the case material and to draw conclusions from the single-case study (Boyatzis 1998). This approach is flexible and valuable in making sense of rich qualitative data, particularly in case study contexts (Braun & Clarke 2006).

According to Williams and Moser (2019), thematic analysis allows researchers to explore experiences and perceptions, thereby providing deeper insights into how and why certain processes and decisions are made. Data were transformed from its raw form to coded segments, ensuring that meaning is preserved and patterns are revealed (Braun & Clarke 2013). As outlined in the literature review, the researcher identified methods and standards utilised in data analytics. This provided predetermined deductions and inductive insights, including the identification of phases of data analytics. Consequently, the researcher was able to predetermine themes and codes derived both from existing literature and participant data.

Thematic analysis focused on understanding the processes, techniques, tools and conclusions evident in the case documents from the petrochemical company. These methods and standards were compared across proactive and reactive FDA engagements. Data extracted from the case documents were analysed to identify similarities and differences in the techniques and tools applied across varied scenarios. Each code contributed to the thematic analysis by linking specific methods, techniques and tools to individual cases. This coding process enabled the researcher to structure the analysis systematically and to interpret qualitative evidence from the documentary record. Importantly, thematic analysis reduced the likelihood of overlooking significant patterns or themes within the research data (Charmaz 2000).

Data analysis was qualitative, emphasising meaning and interpretation rather than reduction to variables (Ary et al. 2018). Following Mayer (2015), the researcher described, classified and connected phenomena to research concepts. Data were organised into themes and subcodes, distinguishing proactive and reactive FDA approaches. Accuracy was enhanced through data-cleaning and verification checks, ensuring completeness and reliability (Morse & Niehaus 2012). Two researchers independently reviewed the coding, discussed discrepancies after each round and refined the coding framework until consensus was reached. This process yielded 26 codes, which were consolidated into nine main themes.

The findings from the petrochemical case study highlight how the FDA functions as both a proactive and reactive mechanism in fraud detection. Proactive FDA emphasises early identification of anomalies through risk-based assessments, trend analysis and red-flag detection, thereby strengthening internal controls and reducing exposure to EC. Reactive FDA, by contrast, is corrective in nature, initiated after allegations or whistleblower reports, and focuses on quantifying losses and reinforcing failed controls. Together, these approaches demonstrate the dual role of the FDA in enhancing both preventative and detective measures.

The thematic and content analysis further revealed a consistent reliance on direct system access, rigorous data-cleaning procedures and specialised tools such as Arbutus and Power BI. These practices underscore the importance of methodological rigour and technological capability in producing credible and reliable fraud-detection outcomes. The emphasis on hash totals and record counts (Nigrini 2011; Ramaswamy, Rastogi & Shim 2000) confirms that data-integrity checks are indispensable in forensic auditing, while the preference for advanced visualisation platforms reflects the growing need to communicate complex findings to diverse stakeholders. Table 2 presents the themes and codes.

In the discussion that follows, DA refers to the data analytics team or function operating within the forensic audit environment.

This study was undertaken to understand how auditors apply data analytics in fraud detection. Drawing on both a literature review and a single case study, the research provides insights into the processes, tools and techniques that underpin FDA engagements. The study confirms that the integration of technological solutions strengthens fraud-detection systems, reduces failures and enhances financial security. Effective fraud detection requires organisations to manage datasets across multiple platforms, with the FDA playing a central role in identifying and evaluating EC risk variables.

The literature review emphasised the growing importance of proactive monitoring techniques and the structured application of FDA across complex data environments. The case study similarly demonstrated the value of a clear FDA lifecycle, from data identification and acquisition to analysis, reporting and outcome evaluation. Nine core themes emerged from the empirical analysis, including data identification, acquisition, cleaning, analytics, external assistance, reporting and EC conclusion.

Outcomes across the 23 FDA engagements varied. Twelve engagements revealed no substantiated evidence of wrongdoing, nine indicated possible EC and were referred for further investigation, and two confirmed fraud. Notably, the confirmed fraud cases were reactive in nature and required extensive analysis of large and complex datasets. These findings highlight the critical role of the FDA in reactive engagements while also demonstrating its screening value in proactive assurance work.

The study demonstrates that FDA is not merely a technical exercise but a holistic process requiring planning, stakeholder engagement, legal compliance and quality assurance. It also highlights the challenges auditors face, including restricted access to sensitive data, the complexity of cleaning large datasets, the need for specialised tools and weaknesses in downstream referral processes. Addressing these challenges requires investment in training, infrastructure and collaborative frameworks that support forensic auditors in applying the FDA effectively.

Ultimately, the case study underscores that the FDA is a cornerstone of modern fraud detection. Its proactive and reactive dimensions provide organisations with both early warning systems and corrective mechanisms, thereby strengthening resilience against EC. The integration of the FDA into assurance services represents a forward-looking approach that aligns with broader trends in governance, accountability and compliance.

The study highlights that fraud-detection effectiveness depends heavily on the rigour of data analytics approaches. Analytical techniques, including duplicate and gap analysis, clustering, association analysis and log analysis, were particularly useful in detecting complex patterns of fraudulent activity. Forensic data analytics therefore play both a confirmatory and preventative role in modern fraud detection. This study is limited to a single internal forensic audit environment within a petrochemical company, which constrains analytical generalisation. Future research could compare the application of the FDA across industries and examine how artificial intelligence and machine learning can extend automated and predictive fraud-detection capabilities.