These are not illustrative scenarios. They are engagements where real businesses had real money missing, real leadership compromised, or real controls that had already failed. What follows is what we did — and what happened because of it.
Two engagements. Different sectors. The same hard truth — by the time the owner suspected something, the damage had been building for years.
An industrial manufacturing plant. The CFO had been in the role for years — trusted, senior, and unchecked. When the owners began to suspect something was wrong, they had no audit trail, no documentation, and no way to quantify what had been taken. What they needed was evidence that would stand up before the Public Prosecution, the Police, and a court.
Stolen funds recovered. Travel ban obtained. Legal claims filed. The client had answers, evidence, and a result — not just a report.
Eight million dollars. A regulated GCC bank. Internal fraud of that scale carried two simultaneous risks: the financial loss itself, and what exposure to regulators and the board would mean if the investigation was handled poorly. This required precision — both in uncovering what happened and in how every finding was documented and communicated.
Fraud fully uncovered. Every stakeholder properly served. Board, regulators, lawyers, and audit committee received exactly what they needed. Controls rebuilt.
Two engagements where the investigation crossed borders, implicated leadership, and demanded findings that could withstand scrutiny in multiple legal systems at once.
Two separate investigations. Two major real estate development projects — one in the UAE, one in Saudi Arabia. In each case, the boards and owners had reason to believe that the person running the operation was the source of the problem. At that scale, and at that level, the investigation had to be unimpeachable.
Fraud schemes uncovered. Culprits identified. Full reporting chain delivered. Legal proceedings supported in both jurisdictions through to conclusion.
A prominent GCC family. A disputed inheritance involving more than ten heirs, suspected misappropriation, and assets that had been deliberately moved across multiple international jurisdictions. The Ruler’s Court in Dubai was involved. Every conclusion drawn had to be defensible before several legal systems at the same time — with a team of individuals and interests that could not be fully aligned.
Assets traced and identified across multiple countries. Estate dispute resolved. Value preserved across jurisdictions. All proceedings successfully supported.
Two engagements where the risk was not a rogue employee — it was a business relationship that nobody had properly examined.
Two family offices, both entering UAE markets with serious capital and no independent capacity to assess what they were entering. Both had JV partners, intermediaries, and deal structures that looked sound from the outside. Neither had been independently verified. In both cases, what we found when we looked changed the picture materially.
Fraud identified. Further losses prevented. Both clients remain active advisory relationships — ongoing retainer covering their GCC businesses.
A major construction operation running projects across the GCC. Procurement fraud was suspected but unquantified — inflated invoices, vendor collusion, manipulated change orders. Management knew something was wrong and couldn’t determine the scale without disrupting active projects or tipping off the people involved.
Multiple fraud schemes dismantled. Employee collusion exposed. Controls rebuilt. Whistleblower channel established. Losses stopped.
Investigations across the GCC’s most operationally complex sectors — where the fraud and the fix both required deep sector knowledge.
Internal investigations across Oil & Gas and Construction clients in the GCC. In every case the investigation was only half the mandate — what came after mattered just as much. Findings without remediation leave the same door open.
Fraud identified, root causes addressed, controls embedded. Clients left with capability — not dependency on external advisors.
Over 25 Fraud Risk Assessments across private and public sector entities in the GCC — identifying exposure before it became a loss. Alongside those, 40+ fraud audits, investigations, and FCPA compliance reviews spanning bribery, procurement fraud, payroll manipulation, conflict of interest, and supplier collusion.
25+ Fraud Risk Assessments. 40+ audits and investigations. Across Government & Regulatory Authorities, Construction, Oil & Gas, Financial Services, and Family Businesses throughout the GCC.
Worked directly with UAE federal authorities to establish the country’s national standard for fraud prevention, detection, and response. The output was a complete governance framework — policies, procedures, and controls — adopted across multiple federal government entities.
Assisted the KSA Ministry of Finance in building the frameworks that govern fraud risk management, corruption prevention, and misconduct control across public entities throughout the Kingdom. Aligned with Vision 2030 governance requirements and the mandate for public sector transparency.
Analysis of multi-billion USD government expenditure — examining what was spent, who received it, and whether the outcomes justified the mandate. Projects were descoped, spending was realigned, and national vision objectives were re-anchored to actual performance and compliance data.
What this means for private clients: The governance frameworks Goodwork designs are built to the same standard as the ones adopted nationally. Not adapted from foreign models. Not theoretical constructs. Frameworks that have been stress-tested at the highest level of public accountability in the GCC — and applied practically in private operations ever since.
Two current engagements running under active retainer. Different clients, different sectors, same principle — a continuous advisory relationship that keeps pace with the business.
A Saudi fintech growing rapidly under regulatory supervision. The business had outgrown its fraud controls before properly building them. The mandate: a fraud prevention framework that met regulatory requirements, that the internal team could actually operate, and that would scale as the institution grew. Not a document. A working capability — built and now maintained under ongoing advisory.
Framework built. Team trained. Ongoing retainer active. Fraud prevention embedded in how the institution operates — not managed from the outside.
Two family offices with active investments in the UAE. Both relationships began as investigations — fraud was uncovered, losses were stopped, legal proceedings were supported. Both clients chose to move from a closed engagement to an ongoing advisory mandate. The rationale was straightforward: the risks that created the original problem did not disappear. The business continued. So did we.
Both clients on active retainer. Engagements that began with a crisis now provide continuous protection — advisory, investigative, and governance capability available on demand.
The ones who acted early recovered more, spent less, and came out in a stronger position. The ones who waited paid for it. If something feels wrong in your business — a person, a relationship, a number that doesn’t add up — the right conversation to have is a confidential one. No commitment required.
Led by Maher Hashash, CFE · Managing Director, Goodwork LLC · UAE · Online · goodwork.ae · All client identities and engagement details have been fully anonymised. Figures represent the scale of matters handled and have been converted to USD where applicable. This document is confidential.