When an investigation begins, the problem is rarely too little information. The harder challenge is knowing which facts matter, how they connect, and what they reveal.
Organizations now collect and store more data than ever, but volume alone does not move an investigation forward. In many matters, the challenge is understanding what documents mean, how they connect, and where further scrutiny is warranted. That shift is changing how leading organizations approach investigations. It is also creating a stronger case for a more integrated model, one that brings together e-discovery, open-source intelligence, relationship mapping, and data analytics. In our recent webinar, “Real-World E-Discovery Insights Into Modern Investigations,” we described that model as a Forensic Intelligence Framework.
That framing matters because investigations no longer stop at collection and review. E-discovery still plays a foundational role, but its value is no longer limited to storage, search, and production. E-discovery centralizes evidence across sources, improves speed and consistency, and helps teams cut through the noise, but collection does not equal understanding. Documents rarely provide full context, key relationships may remain hidden, and intent is often difficult to infer from the face of the record alone.
This is where forensic intelligence may become a practical response to the complexity of current investigations.
Why Is the Model Changing?
The traditional investigation model was built around a review workflow. Gather information, process it, search it, review it, and extract what appears relevant. That approach still has value, but it is increasingly strained by the realities organizations face today.
There are several common pressures:
- Rapid growth in data volumes
- Greater diversity of data sources
- Higher expectations for speed and precision
- Cost pressures
- A persistent lack of context when teams rely too heavily on internal records alone
At the same time, the balance of data has shifted. Unstructured data, including emails, chats, attachments, texts, and other communications, has grown far faster than structured data and now is estimated to comprise over 90% of the total data volume of organizations1. That matters because unstructured data usually contains the nuance and narrative of a matter, but it is also harder to review efficiently and to interpret in isolation.
For leadership teams, the implication is straightforward. The ability to prioritize what matters and interpret it to act quickly is paramount.
What Does Forensic Intelligence Look Like in Practice?
The Forensic Intelligence Framework brings together several distinct but connected capabilities:
- Open-Source Intelligence (OSINT)
- Text and communications intelligence
- Data mining and analytics
- Social network analysis
- Digital forensics
- Active intelligence (surveillance)
Within that structure, e-discovery functions as the foundation, the central mechanism for storing, organizing, and searching investigative data.
What makes the framework useful is that it does not treat those capabilities as separate workstreams. E-discovery is enhanced by open-source intelligence (OSINT) and external context. Analytics deepen understanding. AI can improve efficiency and prioritization. In turn, those insights feed back into the investigation and refine what should be reviewed next. Rather than operating in a vacuum, insights from each component of the forensic intelligence framework feed the others in a seamless, integrated manner.
That feedback loop reflects how many complex investigations actually unfold. Teams do not simply review a static set of information and then draw conclusions. They form working hypotheses, test them, identify gaps, follow new leads, and return to the evidence with a better understanding of which people, communications, transactions, or patterns deserve closer attention.
In that sense, forensic intelligence is less about adding more tools and more about improving how investigative work is directed.
From Volume-Based to Relevance-Based Review
This is signaling a move from broad, volume-based review to relevancy reviews supported by analytics. External analytics can create normalized datasets for deeper analysis, extend insight beyond native review tools, support continuous and iterative investigation, improve focus, and lower downstream review costs. Built-in features such as collaborative review, advanced search, email threading, near-duplicate detection, timeline analysis, and relationship mapping can also help teams focus attention more effectively.
That shift is important for both cost and defensibility. In a large matter, the issue is whether teams can separate signal from noise early enough to support the right decisions. Better prioritization can reduce wasted review effort, improve consistency, and make it easier to explain why key decisions were made during the course of an investigation.
Technology-assisted review (TAR), like Intella Connect’s Predictive Coding, also fits into this picture. TAR uses machine learning, not generative AI, to learn from reviewer decisions and predict what high-relevance items should be reviewed next. When properly designed and validated, it can significantly reduce review time and cost while remaining defensible.
Why Context Changes Outcomes
Context is what turns information into insight. Open-source intelligence can add external facts and relationships that internal systems do not capture. Relationship mapping can surface direct and indirect connections, highlight anomalies, and turn disconnected evidence into an understandable network. Data mining can identify recurring fraud indicators, patterns, and outliers at scale and over entire data sets rather than relying on limited sampling.
Taken together, those capabilities can help organizations answer more meaningful questions. Not simply what was said in a communication, but who else was connected to the matter. Not simply whether a transaction appeared routine, but whether it fits a broader pattern that warrants closer review. Not simply whether records were produced, but whether the story behind those records holds up when tested against information from outside the organization.
That is where the concept of forensic intelligence is likely to resonate most with executives and boards. It supports a more complete view of risk.
Stronger Investigative Capability for Leadership Teams
For general counsel, compliance leaders, audit committees, and executives, the case for forensic intelligence is strategic, not just functional.
Investigations increasingly influence litigation posture, regulatory response, financial exposure, and reputational consequences. The organizations that respond well are often the ones that can move quickly without sacrificing judgment. They can centralize evidence early, apply the right context, identify the relationships that matter, and focus resources where risk is concentrated. In practice, start with e-discovery early, go beyond the documents by layering in OSINT and relationship mapping, and use analytics and data mining to prioritize risk and turn large datasets into clear, defensible action.
That does not mean every matter requires an expansive intelligence buildout, but it may mean the old line between document review and investigation is becoming less useful. In many matters, the better question is whether the organization has a repeatable way to connect data, context, and analysis when the facts are incomplete, and the stakes are high.
Proactive Continuous Monitoring & the Flywheel Effect
It has been our experience that over 90% of fraud and risk investigations we’ve performed since the late 1990s exhibit the same signals as previous matters—the same patterns, behaviors, and statistics. Further, those signals of fraud and risk did not manifest themselves in the data once we bothered to look. In many cases, they were there for months or years, waiting to be seen. Proactive intelligence gathering operates on the principle of “there is nothing new under the sun.”
By deploying a near real-time system of monitoring transactions for the same fraud and risk signals used in an investigation, organizations are more likely to catch suspicious transactions as they occur or unusual transaction patterns as they emerge. Often, the very act of monitoring, identifying anomalies, and then adjusting policies, procedures, or best practices creates a feedback loop that can strengthen the whole system, make detection easier, and reduce the opportunities fraudsters look for when attempting to game the system. Monitoring also helps prevent inadvertent mistakes that can lead to employment litigation. The idea of a constantly self-improving feedback loop is known as the “Flywheel Effect” (as coined by Jim Collins), and it can lead to a far more secure environment to help protect the organization’s assets, employees, and reputation.
Actions to Consider Now
For leadership teams evaluating whether their current approach is keeping pace, consider the following:
- Assess whether your investigation process is still centered on document collection rather than interpretation and prioritization.
- Review how early e-discovery is introduced in significant matters and whether it is being used as a strategic foundation rather than a downstream task.
- Identify where external context, including OSINT and relationship mapping, could strengthen credibility assessments and issue spotting.
- Evaluate whether analytics are helping your team focus on relevance, patterns, and anomalies instead of reviewing large datasets too broadly.
- Consider using the forensic intelligence framework as part of an organization-wide continuous monitoring system to help catch fraud and risk before they get out of control.
How Forvis Mazars Can Help
Complex investigations rarely fit neatly within a single workflow. If your team is evaluating how to connect e-discovery, analytics, OSINT, and investigative strategy more effectively, Forvis Mazars can help. Connect with our professionals to discuss your matter or learn more about our Forensics & Investigations services.
- 1“Unstructured data integration,” ibm.com, accessed July 16, 2026.