Change Order Fraud & Cost Overrun Scams in Construction Projects

Change order fraud is the manipulation of construction change orders to inflate project costs through unnecessary, duplicated, or fabricated work. Because change orders modify the original contract after work begins — often under time pressure and with limited scrutiny — they are one of the most exploited mechanisms in construction fraud. Forensic accountants detect these schemes by reconciling billed work against contract scope, actual labor and materials, and project documentation to separate legitimate changes from manufactured cost overruns. The ACFE’s fraud tree classifies this activity under billing and asset-misappropriation schemes, and the construction and manufacturing sector appears consistently among the industries the ACFE’s Report to the Nations flags for elevated fraud losses.

How Contractors Commit Change Order Fraud

The mechanics are consistent across projects:

• Fabricated changes — billing for work that was never requested or performed.
• Inflated pricing — charging above-market rates for labor or materials on change-order work that escapes competitive bidding.
• Duplicate billing — invoicing the same work under both the base contract and a change order.
• Scope manipulation — deliberately underbidding to win the contract, then recovering margin through a stream of change orders (front-end loading).
• Unnecessary changes — engineering avoidable “problems” that require paid remediation, sometimes tied to bid rigging or collusion.

These schemes rarely occur in isolation. A contractor who front-loads a bid to win the contract often has a parallel interest in minimizing competitive pressure on the change-order stream that follows, which is why change order fraud and bid rigging frequently appear together in forensic reviews of public works and large private developments. Subcontractor collusion, change-order kickbacks to project managers, and falsified daily logs are common companions to the core schemes above.

Project owners should also understand that change order fraud is not limited to the contractor side. Owner’s representatives, construction managers, and even inspectors can be complicit — approving change orders in exchange for payments, or failing to challenge pricing because of a personal relationship with the contractor. This is one reason forensic engagements typically examine the approval chain as closely as the billing itself, and it overlaps with broader corporate fraud detection work when internal personnel are involved.

Red Flags That Signal Change Order Fraud

The clearest warning sign of change order fraud is a pattern — not a single anomaly — across volume, timing, pricing, and documentation of change orders. Cost overruns are normal on complex projects; fraudulent ones follow identifiable patterns that a trained reviewer can isolate from legitimate scope growth.

Specific red flags include:

• A disproportionate volume of change orders relative to the original contract value (some public agencies flag projects once change orders exceed roughly 10–15% of contract price for further review).
• Changes concentrated late in the project, after the owner’s attention and oversight capacity have both diminished.
• Vague or non-specific change descriptions that reference “additional work” or “field conditions” without quantities, drawings, or unit pricing.
• Pricing that consistently exceeds market rates for labor, equipment rental, or materials, often without supporting quotes.
• A single contractor or subcontractor whose change orders always clear approval without challenge or negotiation.
• Change orders that reference the same “unforeseen condition” repeatedly across unrelated phases of work.
• Missing or backdated documentation — requests for information (RFIs), field directives, or daily reports that appear to have been created after the fact to support a change order already submitted for payment.

Any one of these may be benign on its own. A late-stage change order can reflect a genuine design revision; a high-priced line item can reflect scarce materials. Forensic review exists precisely because context determines whether a pattern is explainable or engineered, and that context comes from documents, not assumptions.

How Forensic Accountants Investigate Change Order Fraud

A forensic construction audit reconstructs the project financially and compares it against physical reality. The process is sequential, and skipping a step tends to produce findings that collapse under cross-examination or opposing expert review.

1. Contract and scope baseline — establish exactly what was agreed and priced, including unit-price schedules, allowances, and exclusions in the original contract.
2. Change order reconciliation — match each change to a documented request, justification, and approval signature, flagging any that lack a traceable origin.
3. Cost verification — trace billed labor, equipment, and materials to payroll records, certified timesheets, delivery tickets, and supplier invoices.
4. Physical validation — confirm, through site inspection, photographs, or progress reports, that billed work actually exists on site and matches the quantities claimed.
5. Quantification — calculate the overbilled amount as defensible, line-item evidence suitable for recovery, settlement negotiation, or trial.

Analytical techniques borrowed from broader forensic accounting practice often strengthen this work — reconciliation of job-cost ledgers against general ledger entries, variance analysis comparing budgeted versus actual costs by cost code, and in larger projects, Benford’s Law screening of invoice amounts to flag numerically improbable billing patterns for closer review. These methods overlap with the firm’s asset tracing and procurement fraud work, where tracing payments through shell vendors or related-party subcontractors is often necessary to establish who ultimately benefited from inflated billing.

What Documents and Evidence Are Reviewed in a Change Order Fraud Investigation

A change order fraud investigation reviews the full paper trail of a project — from the original contract to final payment — rather than relying on summary billing alone. Core documents typically include the prime contract and all exhibits, the schedule of values, every change order request (COR) and its supporting backup, RFIs, daily field reports, certified payroll, material delivery tickets, subcontractor invoices, canceled checks or ACH records, lien waivers, and correspondence (email, submittals, and meeting minutes) discussing the disputed scope.

Where litigation or a claim is anticipated, investigators also request the project schedule (baseline and as-built), photographs or drone survey data documenting progress at key milestones, and any prior audits performed by the owner, surety, or lender. Discrepancies between what a contractor represented in a progress payment application and what the schedule or photographs show at that date are frequently the clearest evidence a trier of fact can understand without specialized training.

Legal and Contractual Context for Change Order Fraud

Change order disputes sit at the intersection of contract law, construction law, and in many cases civil or criminal fraud statutes. Public works projects are typically governed by statutory change-order procedures and competitive bidding requirements, and a contractor who circumvents those procedures through fabricated change orders may face exposure under state false claims statutes in addition to breach-of-contract claims. On federal projects, the federal False Claims Act creates civil liability — including treble damages — for knowingly submitting false or fraudulent claims for payment, which has been applied in contractor overbilling cases.

Private-project disputes more often proceed as breach of contract, fraud, or unjust enrichment claims, frequently resolved through the dispute-resolution or arbitration clauses common in standard AIA or ConsensusDocs contract forms. Sureties investigating a bond claim, and insurers evaluating a builder’s risk or fidelity claim, apply a similar standard: can the loss be quantified and documented well enough to support payment or denial. Counsel evaluating these matters should treat forensic quantification as a component of, not a substitute for, legal strategy, and should consult directly with litigation counsel on which claims and remedies apply to a specific contract and jurisdiction.

How MSN Forenzix Approaches Change Order Fraud

Our engagements on change order and construction billing disputes begin with scoping: defining the contract period, the change orders in dispute, and the records that will need to be produced by the contractor, owner’s representative, or both. We work with counsel to issue targeted document requests rather than open-ended ones, because construction disputes generate enormous volumes of paper and the relevant evidence is usually concentrated in a smaller set of change orders, payment applications, and underlying backup.

Once records are collected, our analysis follows the reconciliation sequence described above — baseline, change-order matching, cost tracing, and physical validation — supplemented by interviews with project personnel where appropriate and coordinated through counsel. Findings are documented in a report that lays out the methodology, the source documents relied upon, and a line-item schedule of disputed amounts, structured so that it can support settlement discussions, a demand letter, or testimony. Where a matter proceeds to litigation or arbitration, the same analyst who performed the reconciliation is typically positioned to serve as a testifying expert, since credibility on cross-examination depends on the witness having done the underlying work rather than summarizing someone else’s analysis. This work connects closely to our broader forensic investigation services and, for owners managing exposure across an active project, our integrity monitoring engagements.

Who Relies on Change Order Fraud Investigations

Project owners, developers, public agencies, and sureties engage forensic accountants when a project’s costs diverge from its plan without clear justification. Early review protects the remaining budget and preserves the documentation needed for litigation or claims.

Attorneys representing either side of a construction dispute use forensic findings differently depending on posture. Plaintiff-side counsel use the quantified overbilling schedule to support a demand or complaint and to establish damages with the specificity courts expect. Defense counsel — representing a contractor accused of change order fraud — use the same forensic process to test whether the owner’s allegations hold up against the documentary record, since not every cost overrun reflects misconduct. Insurers and sureties rely on forensic review to decide whether a performance-bond or builder’s-risk claim is supported by the facts before authorizing payment, which is a core function of our insurance claims analysis practice and relevant to the broader construction industry forensics work we perform.

Red Flag	What It Suggests	Forensic Response
Change orders exceed 15–20% of contract value	Possible front-end loading or scope manipulation	Compare original bid pricing to change-order pricing for the same cost codes
Vague scope descriptions	Billing may not map to verifiable work	Request RFIs, drawings, and site photographs tied to each change
Late-project concentration	Oversight fatigue being exploited	Reconcile against the as-built schedule and progress reports
Pricing above market rate	Inflated labor/material billing	Trace to certified payroll, supplier invoices, and delivery tickets
Repeated “unforeseen conditions”	Possible fabricated or duplicated claims	Cross-reference prior change orders for duplicate justification language

Frequently Asked Questions

How do contractors commit change order fraud?

Contractors commit change order fraud by billing for fabricated or unnecessary work, inflating labor and material pricing on changes that avoid competitive bidding, duplicating charges across the base contract and change orders, and underbidding to win the job before recovering margin through a stream of changes. Weak oversight of post-award changes enables all of these.

What are signs of cost overrun scams?

Red flags include an unusually high volume of change orders relative to contract value, changes concentrated late in the project, vague change descriptions, pricing consistently above market rates, and a contractor whose changes always clear approval without scrutiny. Individually these may be legitimate; in combination they signal the need for a forensic audit.

How to audit construction billing for fraud?

Establish the contract and scope baseline, reconcile every change order to a documented request and approval, trace billed labor and materials to payroll, timesheets, and supplier invoices, and physically verify that the work exists. The difference between what was billed and what was justified becomes the quantified basis for recovery.

Who should order a change order fraud investigation?

Project owners, developers, public agencies, sureties, and the attorneys representing them typically order a change order fraud investigation once costs diverge materially from the approved budget without adequate explanation. The trigger is usually a combination of red flags rather than a single disputed invoice — repeated vague justifications, a contractor resistant to producing backup documentation, or a surety reviewing a bond claim before authorizing payment. Counsel often engage a forensic accountant early, before a dispute hardens into litigation, because contemporaneous documentation is far easier to collect and verify than records requested months or years later.

Can change order fraud lead to criminal charges, not just a civil dispute?

Yes — change order fraud can expose a contractor to criminal charges, particularly on public projects, in addition to civil liability for breach of contract or fraud. On federally funded projects, knowingly submitting fabricated or inflated claims for payment can trigger liability under the federal False Claims Act, and conduct involving mail or wire transmission of fraudulent invoices can implicate federal mail and wire fraud statutes, which agencies such as the FBI and the Department of Justice have pursued in public-works contracting cases. State false claims acts and construction-licensing boards may impose additional civil penalties or licensing consequences. Whether a given set of facts supports criminal referral, civil suit, or both is a legal determination that should be made with litigation counsel, not by the forensic accountant alone.

Sources

Association of Certified Fraud Examiners — Report to the Nations

U.S. Department of Justice — The False Claims Act