Timesheet Fraud Detection for a Metro Construction Consortium

We built a UiPath robot as the analytics engine of the internal audit. It turned the company's own timekeeping reports into data, looked for clock-ins that were statistically too synchronised to be genuine, and tested every suspect against the access-control system.

From timekeeping report to audit evidence

1. Report to data. The robot read the timekeeping report (PDF), parsed every employee block and day with pattern matching, and built a table of 61,138 daily records for 154 employees over 13 months: role, site, up to three entries and exits a day, and totals.
2. Synchronised clock-in detection. For every day it compared each employee's entry and exit times with every other employee's, and flagged pairs who clocked in and out within 0, 1, 2, 3 or 4 minutes of each other: the signature of one person stamping two badges.
3. Weekend-work check. Saturday and Sunday stamps counted per employee as a second indicator.
4. Cross-check against the gates. Every suspect's recorded shifts were checked, month by month, against roughly 1.4 million access-control events across 98 site locations, to confirm whether the person actually passed the gate.
5. Evidence for the auditors. Results written to workbooks per check and per time interval, with the matching gate events alongside, so the audit team could review every case.

From thousands of coincidences to a reviewable list

Same-minute entries alone are common on a busy site: more than 2,000 entry-only coincidences at zero minutes apart. Requiring both entry and exit to match cut that to fewer than 30 pairs per interval, and the gate cross-check then put each suspect's own badge events beside the clock record. The auditors reviewed evidence, not a statistic.

Built for the investigation

Fast, single-purpose analytics run under audit direction, on records the company already held, rather than a permanent production robot.

Technology

The audit team got what it could never have produced by hand: every suspect clock-in, side by side with the gate record that confirms or contradicts it.

• About 14% of the employees reviewed showed malicious clocking behaviour.
• Several hundred hours paid but not worked uncovered over the period reviewed. At an average construction labour cost of about €24 an hour, that is roughly €7,000–€22,000 (our estimate).
• 13 months of timekeeping and 1.4 million gate events reconciled, an exercise that is not feasible by hand.
• Evidence per case for the internal audit investigation.

The risk most teams miss

A timekeeping system checks that a badge was used, not who used it. Fraud that relies on a colleague's hand looks perfectly normal record by record; it only shows when records are compared with each other and with a second, independent system. The other trap is employee-monitoring law: checks on staff are regulated, GDPR included, so the analysis has to run on records the company already lawfully holds, under an audit mandate, with findings reviewed by people before anything is acted on.