Automatic Fraud Red Flag Escalation
Every hour, WebRun checks the matter's CaseWare IDEA project for any red flag that crosses a high-severity threshold, combining signals like repeated duplicate payments, a sharp Benford's Law deviation, or a cluster of round-dollar disbursements to one payee, pings you on Telegram right away, and drafts an escalation memo in Gmail that stays unsent until a partner reviews it.
How do I get an immediate alert when forensic accounting analysis flags a serious fraud red flag?
Every hour, WebRun checks the matter's CaseWare IDEA project for any red flag that crosses a high-severity threshold, combining signals like duplicate payments and Benford's Law deviations into a single score. It pings you on Telegram the moment one crosses the line and drafts an escalation memo in Gmail that stays unsent until the engagement partner reviews it.
- A high-severity red flag reaches a partner within the hour, not the next morning
- Nothing about a fraud suspicion ever reaches a client or outside party automatically
- Multiple weak signals get combined into one score instead of separate, easy-to-ignore alerts
Built for forensic accountants · fraud examiners · engagement partners · internal audit teams
What does WebRun do on every run?
The exact actions WebRun takes, in order - in plain language, so you can adjust anything.
-
WebRun signs in and gets to work
Opens
www.caseware.com/products/ideain a real browser with your saved login - no setup, no API keys. -
1
CaseWare IDEA - check for high-severity red flags
caseware.com
WebRun checks CaseWare IDEA's exception results for high-severity red flags. - Open the matter's project and check this hour's exception test results
- Combine related signals into a single red flag score, such as duplicate payments plus a Benford's Law deviation on the same account
- Flag anything scoring above the high-severity threshold you set
Done when Any red flag above the high-severity threshold is identified with its supporting signals.
-
2
Telegram - ping you right away
telegram.org
WebRun pings you on Telegram the moment a high-severity red flag is found. - Message you immediately when a red flag crosses the threshold
- Include the account, the combined signals, and the severity score
- Note that a full escalation memo is being drafted in Gmail
Done when You have an immediate Telegram alert for any high-severity red flag.
-
3
Gmail - draft the escalation memo
gmail.com
WebRun drafts the fraud escalation memo in Gmail and leaves it unsent. - Draft an escalation memo summarizing the red flag, the supporting signals, and the account or transactions involved
- Address it to the engagement partner
- Save it as a draft and leave it unsent. Never send a fraud escalation to the client or any outside party automatically
Done when An escalation memo draft sits ready in Gmail, unsent, for the partner to review.
How is each run configured?
Secure by default
Connect once, stays signed in
WebRun signs in once and keeps each session in a persistent environment, so every run picks up right where it left off.
Every action is checked against this policy before it runs.
Questions, answered
Does it notify the client or anyone outside the firm?
No. WebRun only pings you on Telegram and drafts an unsent memo in Gmail for the engagement partner. A fraud red flag never reaches a client or any outside party automatically.
What makes a red flag high-severity?
It combines multiple signals on the same account or transaction, such as duplicate payments alongside a sharp Benford's Law deviation, and scores it against the threshold you set. A single minor anomaly does not trigger an hourly alert.
Why check every hour instead of once a day?
A high-severity fraud signal can mean an active, ongoing issue. Hourly checks mean a partner hears about it within the hour it is detected, not the next morning.
Related templates
Put this on autopilot.
Turn it on in minutes - or have our team set it up for you.