When a New Question Emerges, How Much Work Happens Before the Investigation Can Actually Continue?

In October 2019, after months of investigative reporting by the Financial Times raised questions about the source of its profits, Wirecard’s supervisory board commissioned KPMG to conduct an independent special investigation. At its center was a deceptively simple question: was the outsourced payment-processing business in Asia that supposedly generated much of Wirecard’s profit real, and did the cash it had supposedly produced, held in trust accounts, actually exist? KPMG’s report, dated April 27, 2020, arrived after its reporting date had been pushed back, and even then it could not answer that question.¹

A Verification Request Is Not the Same as a Verified Fact

KPMG’s report is explicit about why. To confirm the trust account balances, the auditors needed evidence they could check independently against the banks themselves. What they got was second-hand. The original trustee that had managed the accounts ended its relationship with Wirecard in the fourth quarter of 2019, just as the special investigation was getting under way, and according to KPMG no longer responded to Wirecard’s inquiries. A new trustee took over. The bank statements and confirmations KPMG received were electronic copies and scans, several of them arriving only in the final days of the review, and KPMG stated it had not checked their authenticity. Direct confirmations from the banks could not be obtained in time.¹

Two months later, on June 22, 2020, Wirecard disclosed that there was “a prevailing likelihood that the bank trust account balances in the amount of 1.9 billion euros do not exist.” The two banks in the Philippines where the money was supposedly held said Wirecard was not a client.² Three days later, the company announced it would file for insolvency.³

This is not a story about an audit team that moved too slowly. It is a story about what happens the moment a legitimate new question, does this money actually exist, requires an answer from someone outside the boundary of the original engagement. KPMG could at least press Wirecard for its own records. What it could not do, quickly or at all, was compel a trustee who had already cut ties to keep cooperating once the stakes became clear to everyone involved.

The Delay Was Not a Staffing Problem. It Was a Dependency Problem.

It would be easy to read the delay as evidence that KPMG simply needed more time or more people. That misses the actual mechanism. The report was delayed, and even the delayed version was incomplete, because the single fact the entire audit turned on depended on the continued goodwill of a party who had no further obligation to provide it. Once the special audit started, the original trustee’s incentive to cooperate disappeared at the exact moment its cooperation became indispensable. No amount of additional KPMG staff hours could substitute for that.

This pattern is not unique to Wirecard. The Association of Certified Fraud Examiners’ most recent global fraud study, based on 2,402 cases investigated by certified examiners across 143 countries, found that financial statement fraud, the category Wirecard’s alleged scheme falls into, accounts for only 6 percent of cases but produces the highest median loss of any fraud category, at $1 million per case.⁴ Asset misappropriation, by contrast, is both the most common scheme type and the least costly by median loss.

The gap is not accidental. A misappropriation case is usually self-contained: the evidence sits inside one organization’s own records. A financial statement or outsourced-revenue scheme, like Wirecard’s, typically requires verifying a claim that lives outside the organization under investigation, with a bank, a trustee, a subsidiary, a counterparty, none of whom are obligated to make that verification easy, fast, or even possible once the investigation is underway.

Questions Worth Asking Before the Dependency Becomes the Bottleneck

• When a fact your investigation depends on sits with an external party, a bank, a subsidiary, a trustee, a former vendor, does your process track that dependency explicitly, or does it only become visible once the request stalls?
• If the party holding a critical piece of verification has no ongoing relationship with your organization, what is your plan for obtaining their cooperation before that relationship ends entirely?
• How would your team know, in real time, that a specific verification request has been outstanding for an unusual length of time, rather than discovering it only when someone asks for a status update?
• Does your investigative record distinguish between a fact that has been confirmed and a fact that has only been requested, so that an unverified claim cannot quietly be treated as settled?

The Harder Question: Would Faster Technology Have Changed the Outcome?

It is tempting to conclude that better investigative tooling would have closed the gap. That claim does not fully hold up. No case management system compels an overseas trustee to answer a document request, and no correlation engine substitutes for the legal and diplomatic work of obtaining verifiable bank confirmations across borders. Some of what went wrong at Wirecard was a matter of engagement design: earlier and more binding cooperation commitments from third parties, negotiated before a crisis made cooperation costly, might have preserved access that disappeared once trust collapsed. That is a process and legal question as much as a technology one.

What technology can reasonably change is something narrower but still significant: whether an organization can see, at the moment a critical fact starts depending on an uncooperative or disappearing external party, that this dependency exists at all. In most investigative workflows, a request sent to a third party and a fact confirmed directly by the investigator look identical in the file until someone goes looking for the difference. That is precisely the gap that turned a delayed report into one that still could not answer its central question.

What Changes When a Dependency Is Visible Instead of Assumed

The distinction worth building an investigative environment around is between a fact that has been requested and a fact that has been verified, and between a source that remains available and one whose willingness to cooperate is quietly expiring. An investigation that treats every externally sourced fact as provisional until independently confirmed, and that flags when a critical dependency sits with a party who has diminishing reason to help, gives investigators the chance to act while the window is still open rather than after it has closed. Hubstream’s approach to enterprise and global investigations is built around that gap: keeping the provenance and status of every fact visible across organizational and jurisdictional boundaries, so that a dependency on a party outside the case does not go unnoticed until the report is already late and the money is already gone.

The Report Wirecard’s Board Ordered Was Never Actually Delivered

KPMG’s special investigation was, in the end, not really a story about a delay. It was a report that could not do the one thing it was commissioned to do, because the question it needed to answer required cooperation from someone who had already decided not to give it. The lesson is not that audits should move faster. It is that any investigation built around a fact controlled by an outside party needs to know, in real time, whether that party still has a reason to answer the question, before the investigation’s own clock runs out.