A forensic audit almost always starts with a bad feeling about a number. Cash is tighter than the sales figures say it should be. A vendor nobody recognizes keeps turning up on the check register. A partner's spending doesn't square with the income on his K-1. The audit is the work of getting into the financial records to find out whether fraud, theft, or manipulation explains that gap, then documenting the answer so it survives if the matter lands in front of a judge, an arbitrator, or the IRS. It's an investigation, not a formality.
How it differs from a regular audit
Most people picture a normal audit when they hear the word. The two jobs aren't the same. A financial-statement audit answers one narrow question: are these statements fairly presented, in all material respects, in line with GAAP? A CPA tests a sample of transactions, checks the internal controls, and issues an opinion. It assumes management is honest unless something forces a second look, and it runs on a deadline.
A forensic audit assumes nothing and starts from the suspicion itself. Rather than sampling, the accountant will often run full-population testing, meaning every transaction in a period instead of a representative slice of forty invoices. That matters, because a dishonest bookkeeper only needs a handful of fake entries to hide, and a sample can miss all of them. The scope isn't set by a calendar. It's set by the question you're trying to answer.
An audit is built to catch honest mistakes at scale. A fraud is built to survive an audit. Those aren't the same problem, and they don't call for the same tools.
What usually sets one off
People rarely order a forensic audit out of curiosity. Something specific rattles them first. A few of the patterns that bring clients in:
- A bookkeeper who never takes a real vacation, handles the bank reconciliation alone, and gets touchy when anyone asks to see it. Uninterrupted control of the money is how small schemes run for years.
- A vendor whose remittance address is a PO box, or matches an employee's home, paid on invoices that always come in just under the approval threshold.
- In a divorce or partnership split, a lifestyle that plainly outruns the income being reported. A boat and two homes on a salary that supposedly can't cover child support is worth a closer look.
The criminologist Donald Cressey explained why these things happen with what's now called the fraud triangle: pressure (a debt, a habit, a business under water), opportunity (weak controls, no oversight), and rationalization (the story the person tells himself, usually that it's a loan he'll pay back). When all three line up, otherwise ordinary people cross a line they never thought they would.
How the work actually gets done
Something in the numbers isn't adding up?
Talk it through in a confidential consultation before you confront anyone or touch the records. What you do in the first week often decides whether the evidence holds.
The process is less dramatic than television makes it look. It starts with scoping: what do we suspect, over what period, whose records, and what would prove or disprove it. Then the accountant locks down the source material before anyone can alter it. That can mean bank statements and the general ledger, or email and a copy of the accounting file.
From there the analysis fits the question. Tracing follows money from where it came in to where it ended up, so a payment to a shell vendor can be walked back to the person who controlled it. Lifestyle analysis sets what someone reports earning against what they visibly spend and own. The net-worth method estimates unreported income by measuring how much a person's assets grew over time against the income that could legitimately explain it. If a business is in dispute, a valuation may follow, drawing on some mix of the income, market, and asset approaches. Interviews usually come near the end, once the paper already tells most of the story and the questions can be sharp.
Keeping the evidence clean
A finding is worth only as much as it can hold up when the other side pushes back, and that comes down to discipline set long before any report gets written. The accountant works from forensic copies, not originals, and keeps a chain of custody showing who touched what and when. Every step gets documented, so a hostile reader can retrace the conclusion. Deleted files and metadata are preserved, not trampled.
Timing and discretion belong here too. Confront the bookkeeper too early, or let word travel, and records start disappearing. A strong case often gets weakened this way before it even begins. When you first suspect something, the right move is usually to say nothing and call someone who does this for a living, not to march into the back office demanding answers.
What you have at the end
You walk away with a written report that lays out what was examined, what was found, and how much money is involved, each point tied back to the specific documents that support it. If the matter heads toward litigation, that report is built so the accountant can defend it as an expert witness under cross-examination. Sometimes the deliverable is a valuation figure for a buyout or a marital estate. Sometimes it's the quiet confirmation that nothing is wrong, which has its own value when a board or a spouse needs to stop wondering.
That last part is worth sitting with. A forensic audit can clear someone as easily as it can catch someone. The point isn't to confirm a fear. It's to swap a suspicion for something you can act on, whether that means firing an employee, filing a claim, settling a dispute, or letting go of a worry that turned out to be nothing.
Think something is wrong with your numbers?
Talk to a forensic accountant. It is confidential, and there is no obligation.