Who is really writing your code?
We compare who the government pays for, who the contract approves, and who actually writes the code. The gaps are the findings.
Timesheets and status reports are claims. Code history is a record of what people did.
Each engagement ends with a written report. Every finding links to evidence from the code history.
Four problems we find
These problems hide behind invoices and status reports. They show up in the code.
Billing fraud
Billed staff who do not appear in the code history. Labor categories that do not match the work. A person billed on more than one contract at the same time.
Unknown contributors
People who write code but are not on the approved roster. Signals of offshore work billed as onshore work. Shared accounts and people who use multiple accounts.
Undisclosed subcontracting
Contributors from companies that are not disclosed in the contract. Evidence for limitations-on-subcontracting reviews.
Key personnel bait and switch
We compare the key personnel named in the proposal with the people who actually do the work. Low or no activity by named key personnel.
How it works
Read-only access. No software to install. Fast answers.
Read-only repository access
We need read access to the code repository only. We also collect the billed roster and the approved roster.
Compare the three lists
We match billed staff, approved staff, and code contributors. Initial insights in less than 48 hours after code access.
Findings with evidence
A detailed final report in two weeks or less. Every finding links to evidence from the code history.
What makes Credelis different
Most IV&V firms test the product. Credelis tests whether the people and the billing are real. No other SDVOSB offers this.
Contributor forensics
We find who did the work, who did not, and who should not be there.
Evidence from behavior
Timesheets and status reports are claims. Code history is a record of what people did.
Review-network analysis
Self-approvals, rubber-stamp approvals, closed review circles, and missing separation of duties.
Statistical findings
A Master Black Belt applies process-control methods, so each outlier has a defined statistical basis.
Read-only access
We need read access to the repository only. No software is installed.
Fast results
Initial insights in less than 48 hours after code access. A detailed final report in two weeks or less.
Representative findings
Real findings, with names and details removed.
A software team member had not committed a line of code in 18 months. Their manager did not know.
An outsourced vendor billed for six developers. Only three did work on the project.
A US vendor used offshore contractors for more than 90% of its billed hours.
An unknown contributor was found in the code. All of their work needed a full review for malware and back doors.
Detailed case examples available in a briefing.
Who we work with
Inspectors General
Evidence from the code to support billing fraud and false claims cases.
Request a briefingProgram offices and CORs
Know who writes your code before you sign the next invoice.
Request a briefingPrime contractors
For primes with fraud and program integrity missions: add software contract forensics to your team.
Start a teaming discussion
Credelis LLC
Founded by Paul J. Mathews, a U.S. Army veteran and West Point graduate. He spent 9 years as an engineering manager and software program manager on Raytheon defense programs, led engineering at a healthcare payment integrity company, and has been CTO and VP of Engineering at several companies in regulated markets. Lean Six Sigma Master Black Belt.
Available for subcontracting and teaming.