global mobility / relocation audit — methodology

what evidence exists and how fast it dies

the first 10 minutes

1. freeze mobility admin accounts named in the alert — do not reset passwords until exports complete.
2. pull Topia assignment audit for the flagged assignment id — host country, policy tier, and approver fields.
3. export Cartus relocation package history for the same assignee and assignment id.
4. request tax equalization gross-up revision log for the assignee's mobility tax year.
5. pull relocation cost detail — temporary housing, household goods, and vendor invoices above policy cap.
6. export payroll reimbursement and deduction rows for the assignment window from HRIS.
7. record svc-mobility-admin or equivalent service account last-login IP and timestamp.
8. check whether dual-approval workflow was bypassed or disabled in the change window.
9. notify mobility compliance and employment counsel — do not let vendor reps "fix" assignment data.
10. begin the path below on read-only exports, not live admin consoles.

the path

1. 1. topia global mobility export forensic analyzer

   Topia assignment and policy export csv. surfaces host-country changes, policy bypass flags, and forensic download events — the Lyons fixture shows ASG-2026-441 host country changed without policy approval by svc-mobility-admin from 198.51.100.92.why first: Topia is the assignment system of record. if host country or policy tier moved before Cartus benefits updated, that sequence anchors unauthorized change.

2. 2. cartus relocation export forensic analyzer

   Cartus relocation package and benefit export csv. flags household-goods allowance inflation, package modifications, and audit download rows tied to the same assignment id.why second: relocation vendors bill against assignment state. parse Cartus after Topia so benefit spikes map to the assignment change that authorized them — or didn't.

3. 3. mobility unauthorized assignment change detector

   mobility assignment change export csv. detects modifications without dual approval, admin overrides, and security alerts on assignment ids — Lyons pack includes ASG-2026-441 changed without dual approval and an admin override on E-44108.why third: platform exports show what changed; this detector shows whether change control was bypassed. one unauthorized row beats three benign policy updates.

4. 4. mobility tax equalization abuse detector

   tax equalization gross-up export csv. flags inflated gross-up percentages, revisions without review workflow, and forensic tax bundle downloads.why fourth: tax equalization abuse is often invisible in relocation invoices — gross-up inflation hits payroll, not the move line item finance reviews first.

5. 5. mobility relocation cost inflation detector

   relocation cost line-item export csv. surfaces temporary-housing overruns, vendor charges above policy cap multiples, and cost export download events.why fifth: cost inflation is the spend fraud layer — temporary housing at 2.4× policy cap is a pattern, not a one-off vendor quote error.

6. 6. cross mobility payroll relocation correlator

   mobility reimbursement csv plus payroll deduction export. correlates relocation reimbursements to payroll deductions and flags mismatches — Lyons fixture includes reimbursement on ASG-2026-441 with no matching payroll deduction.why sixth: mobility fraud often breaks at the payroll bridge. relocation paid out while payroll never withheld is the reconciliation gap auditors miss in siloed exports.

7. 7. multi mobility platform timeline correlator

   two or more mobility platform exports — Topia, Cartus, tax, cost, payroll bridge. builds a unified assignment timeline graph linking cross-platform change clusters on one assignment id.why seventh: the case is multi-platform by design. flat spreadsheets hide that Topia host-country change at 09:20 precedes Cartus allowance double at 11:10 on the same assignment.

8. 8. case report generator

   case metadata form plus evidence file drops. auto-hashes artifacts, structures findings, and generates a forensic report pdf — Lyons fixture seeds LGM-2026-0615 with examiner fields and evidence manifest inputs.why last: counsel and mobility compliance need a signed report with hashes, not a folder of csv exports. generate after the path so findings and timeline are stable.

common false leads

• one inflated invoice equals vendor fraud — check whether assignment policy change authorized the spend first.
• Cartus updated so Topia must match — vendors sync asynchronously; timeline order matters.
• tax gross-up variance is a calculator bug — compare revision actor and approval workflow, not just the percentage.
• payroll mismatch is a timing lag — correlate reimbursement date to deduction cycle, not calendar month alone.
• service account activity is automated — forensic download rows from 198.51.100.92-class IPs are not batch jobs.

what we can tell you, what we can't

we can tell you:

• unauthorized assignment change patterns in mobility platform exports
• tax equalization gross-up inflation flags against policy thresholds
• relocation cost overruns above policy cap multiples
• payroll reimbursement vs deduction mismatches on shared assignment ids
• cross-platform timeline clusters linking Topia, Cartus, tax, and cost events
• structured case report pdf with evidence file hashes

we can't tell you:

• live Topia or Cartus tenant state — you must export csv yourself
• whether a change was legally authorized — policy interpretation is counsel and compliance
• actual tax liability or payroll tax filing correctness — CPA and payroll vendor territory
• vendor invoice authenticity without your AP and vendor contract exports
• guaranteed recovery of overpaid relocation benefits — finance and legal remediation

handing it off

• mobility compliance: assignment timeline csv, unauthorized change flags, dual-approval bypass summary, and affected assignment ids.
• finance / payroll: reimbursement vs deduction mismatch report, gross-up inflation amounts, and cost overrun line items above policy cap.
• employment counsel: admin account activity window, IP source, case report pdf with evidence hashes, and quantified benefit exposure.
• relocation vendors (Cartus / Graebel): assignment id, change timestamps, and package modification audit rows for vendor-side investigation.

further reading

• SHRM — global mobility compliance overview
• IRS — international taxpayers and equalization
• ACFE — fraud examination resources

reference investigation