Forensic Trade Audit: Turning Execution Data Into Dealer Evidence
Every broker reviews trades. Very few brokers audit them forensically. A trade review asks what happened. A forensic trade audit asks whether the evidence can survive pressure: a client dispute, a dealer review, a compliance question, a liquidity-provider conversation, or a board-level explanation of why the book is leaking money. That difference matters. A spreadsheet […]
Every broker reviews trades.
Very few brokers audit them forensically.
A trade review asks what happened. A forensic trade audit asks whether the evidence can survive pressure: a client dispute, a dealer review, a compliance question, a liquidity-provider conversation, or a board-level explanation of why the book is leaking money.
That difference matters. A spreadsheet of losing trades is not evidence. A PNL report is not evidence. A screenshot of a price move after execution is not evidence.
Evidence is a structured chain from raw trading records to an explainable conclusion.
What A Forensic Trade Audit Must Prove
A defensible audit starts with the trade and rebuilds the context around it.
What was the requested price? What was the broker quote surface? What was the independent market tick path before and after the fill? How long did the broker take to process the order? Did the trade receive favourable or unfavourable slippage? Did the markout curve show temporary noise or persistent edge?
The goal is not to find a reason to blame the trader. The goal is to separate ordinary market randomness from repeatable patterns that affect broker risk.
Some trades lose money because markets move. Some trades leak value because execution rules, feed timing, toxic flow, or routing decisions create an exploitable opening. A forensic trade audit must tell the difference.
The Evidence Layers
The strongest audit combines several evidence layers.
Execution timing shows whether the order moved through the platform normally or inside a suspicious timing window.
Markout analysis shows what happened after the trade at fixed horizons such as T+1, T+5, T+60, and beyond. A single markout point is a clue. The curve is the story.
Slippage direction shows whether fills systematically favour the client, the broker, or neither. Random slippage should look noisy. Directional slippage deserves investigation.
PNLFACTORY module context explains the behavioural pattern behind the trade. Latency, Shark, FrontRun, Churner, Sharp, and Clustering evidence answer different questions. A forensic audit becomes much stronger when the trade record is connected to the account’s broader PNLFACTORY profile.
Repeatability separates one-off events from operational risk. One strange trade may be noise. A recurring signature across accounts, symbols, or sessions becomes a risk pattern.
Why Markouts Matter
PNL is too slow to be the first forensic lens. By the time PNL tells you the account won, the evidence path may already be blurred by position management, hedging, partial closes, and broader market movement.
Markouts look immediately after execution. They ask whether the trade was favourable or unfavourable to the broker at fixed time horizons.
If an account repeatedly enters trades that look profitable at T+1 second and then decay by T+60, that is a very different story from an account whose edge continues over minutes or hours. One can indicate timing extraction. The other may indicate genuine directional skill.
The geometry of the markout curve tells the dealer what kind of edge the account is using.
From Audit To Action
A forensic trade audit should lead to action, not just a larger report.
If the audit shows latency-style timing contradictions, the broker may need to review execution rules, bridge timing, last-look settings, symbol configuration, or account restrictions.
If the audit shows skilled directional flow, the broker may need to adjust routing rather than punish the client.
If the audit shows churn-style volume without meaningful risk, the broker may need to review rebate economics or IB relationships.
If the audit shows nothing repeatable, the right action may be no action.
That last outcome is important. A good forensic process protects clean traders as much as it exposes toxic ones. It gives the dealing desk confidence that intervention is based on evidence, not frustration.
What PNLFACTORY Adds
PNLFACTORY turns a forensic trade audit into a repeatable operating process.
Instead of asking analysts to manually stitch together execution timing, markouts, account behaviour, module scores, and verdicts, PNLFACTORY organizes the evidence into a broker-readable risk surface. The composite PNLFACTORY score shows overall risk. The modules explain the source: Latency, Shark, FrontRun, Churner, Sharp, or Clustering. The shared ratios and verdicts translate the evidence into action.
The dealer is not left with a black box. They see why the account is being reviewed.
That is the standard a forensic trade audit should meet.
The Audit Checklist
Before acting on a trade or account, a broker should be able to answer:
- What exact trades triggered the review?
- What did the market do before, during, and after execution?
- Was the account’s edge immediate, persistent, random, or repeated?
- Which PNLFACTORY modules support the concern?
- What ordinary explanations have been ruled out?
- What action is proportional to the evidence?
If the audit cannot answer those questions, it is not ready for a high-stakes decision.
Forensic trade audit is not about producing more data. It is about producing dealer-grade evidence from the data the broker already has.
Trust the Math. Protect the House.