Forensic accounting applies accounting analysis to questions that will be tested in litigation or regulatory proceedings — whether funds were misappropriated, how a loss should be quantified, or whether records were manipulated. It differs from audit in purpose: an audit seeks reasonable assurance, an investigation seeks a defensible answer to a specific question.
Not an audit, and the difference matters
An audit tests whether financial statements are materially correct, using sampling and a materiality threshold, on the working assumption that management is not lying. It is designed to give reasonable assurance about the whole.
A forensic investigation starts from a specific allegation and follows it wherever it goes, without a materiality floor — a $40,000 fraud is not immaterial to the question of whether the controller stole money — and without assuming good faith. The output is written to be defended by a testifying witness rather than to satisfy a professional standard for assurance.
This is why "our auditors didn't find anything" is a weak answer to a fraud allegation. Audits are not built to find it, and saying so is not a criticism of the auditors.
Where the evidence is
The accounting records establish what was recorded. They rarely establish what happened, and the gap between the two is the investigation.
General ledger detail, journal entries — particularly manual entries near period end, which is where manipulation concentrates — bank statements traced to source rather than as summarised, and vendor and payroll master files are the accounting side. The other half is digital: emails and messages showing coordination, documents on devices that contradict the papered version, metadata establishing when a document was really created, and system logs recording who made an entry and when.
The most persuasive findings almost always combine both. A journal entry that reverses a reserve is a fact; an email discussing the need to reverse it, sent an hour before the entry, is a case.
Common engagement types
Asset misappropriation — the most frequent and usually the most tractable, because the money went somewhere.
Financial statement manipulation — revenue recognition, reserve management, expense timing. Harder, because the conduct is often defensible as judgment.
Damages quantification — lost profits, business valuation, and the counterfactual of what would have happened absent the wrong. Quantification is where opposing experts most often diverge, and the divergence is usually about assumptions rather than arithmetic.
Compliance and regulatory response — reconstructing what happened for a regulator, where the reconstruction itself is scrutinised.
Testifying constraints
A forensic accountant's opinion is subject to the same Daubert gatekeeping as any other expert's, and the challenges tend to focus on assumptions rather than method: a damages model whose inputs were supplied by the client and never independently tested, or a counterfactual that assumes a growth rate the company never achieved.
The defence is stating assumptions explicitly, sourcing each one, and showing what the conclusion does under alternative assumptions. An expert who has already run the sensitivity analysis is considerably harder to move in cross-examination than one encountering the question for the first time.
From our work
Dealing with forensic accounting in a live matter?
Our examiners and testifying experts work these questions for a living. Tell us what you're facing.
Reviewed by Law & Forensics. See our editorial standards.