Forensic accounting applies accounting, auditing and investigative skills to questions that may end up in a dispute, a regulator's inquiry or a courtroom. The work product is evidence, a quantified loss or an opinion that someone outside the firm will test. That changes how the work is planned, documented and reported compared with a financial statement audit.
This guide defines the field, separates it from audit, lays out an engagement program practitioners can adapt, and gives a red-flag checklist for the financial statement auditor who meets a warning sign during a regular engagement.
What is forensic accounting?
Forensic accounting covers two broad service lines:
- Investigation. Determining whether a fraud or other loss occurred, how, who was involved and how much was lost. Examples: employee theft, vendor kickbacks, financial statement manipulation, bankruptcy-related asset tracing.
- Litigation and dispute support. Quantifying damages, such as lost profits, breach of contract or insurance claims, and serving as a consultant or testifying expert in civil, criminal or arbitration matters.
The Bureau of Labor Statistics, in its Occupational Outlook Handbook for accountants and auditors, describes forensic accountants as public accountants who investigate financial crimes such as securities fraud and embezzlement, often working with law enforcement and lawyers and sometimes serving as expert witnesses.
Forensic accounting versus a financial statement audit
| Financial statement audit | Forensic engagement | |
|---|---|---|
| Purpose | Opinion on whether the financial statements are free of material misstatement | Answer a specific question: did a loss occur, how much, who |
| Trigger | Annual or periodic requirement | Suspicion, allegation, a dispute or a legal matter |
| Materiality | Misstatements material to users of the statements | No materiality floor in the same sense; small items can matter if they show intent or pattern |
| Approach | Risk-based sampling, reasonable assurance | Targeted, often full-population testing of one area |
| Standards | AU-C (GAAS) | General standards of the AICPA Code, consulting standards (CS section 100) and, for testimony, the court's rules |
| Reader | Financial statement users | Attorneys, boards, insurers, courts |
A financial statement auditor does not become a forensic examiner by finding a red flag. The auditor responds under AU-C 240, communicates, and considers whether the entity should engage a forensic specialist. A forensic examiner engaged to look into a theft does not give assurance on the financial statements. See also fraud risk assessment.
Types of forensic engagement
- Fraud examination: employee theft, vendor fraud, corruption and financial reporting manipulation.
- Damages and lost profit calculations in commercial disputes.
- Asset tracing: locating transferred or hidden assets in divorce, bankruptcy and judgment collection.
- Business valuation disputes and shareholder oppression matters.
- Insurance claims: business interruption and employee dishonesty claims.
- Regulatory and internal investigations commissioned by a board, an audit committee or counsel.
A forensic engagement program
1. Establish predication. Predication is the basis for starting: facts or circumstances that would lead a reasonable, trained and prudent person to believe that a fraud has occurred, is occurring or may occur. Do not start an examination on a hunch.
2. Define the scope and who the client is. Many engagements are best set up through counsel. When an attorney retains the accountant to help the attorney give legal advice, communications may be protected under the line of cases following United States v. Kovel (2d Cir. 1961). Privilege is a legal question; the engagement letter should be drafted with the attorney's input.
3. Secure the evidence. Preserve originals, take forensic images of computers and phones, and keep a log of who held each item and when (chain of custody). Do not work on the only copy of a ledger. Suspend automatic deletion of email and logs.
4. Understand the entity and the suspected scheme. Obtain organization charts, process flows, the chart of accounts and the policies that were supposed to prevent the scheme.
5. Plan the tests. Match the test to the suspected scheme: vendor master and disbursement analysis for billing fraud, payroll register analysis for ghost employees, revenue cutoff and journal entries for financial statement manipulation. See embezzlement detection and journal entry testing.
6. Gather and analyze the data. Obtain full-population data in native format, record its source and record counts, and agree totals to the general ledger before analysis. Typical analysis: duplicates, gaps in sequences, round amounts, transactions near approval limits, weekend or after-hours entries, and relationships among vendors, employees and addresses.
7. Interview. Interview in order from least involved to most involved. Take notes, keep them factual, and have a second person present. Interviews are legal-sensitive; coordinate with counsel.
8. Quantify the loss. Use direct evidence where possible. Where records are incomplete, use indirect methods such as a net worth or expenditures analysis, described below, and state the limits.
9. Report. The report states the scope, the procedures, the facts found and the amount, and distinguishes facts from opinion. Written reports to a party in litigation may be discoverable; discuss the form of the report with counsel before drafting.
10. Support remediation and testimony. In federal court, a testifying expert's opinion must meet the standards of Federal Rule of Evidence 702, and in civil cases an expert report must include the elements in Federal Rule of Civil Procedure 26(a)(2)(B).
Red-flag checklist for the financial statement auditor
Use this when something in a regular audit looks wrong. Each item is a prompt for follow-up, not proof.
Accounting records
- Missing, altered or photocopied documents where originals are normal
- Gaps in check or invoice number sequences
- Unreconciled differences that are "always" small
- Journal entries by senior people with no business reason, near period-end
- Revenue or margin that moves differently from the industry or from cash
Controls
- One person controls a process end to end
- Management overrides controls or cannot explain exceptions
- Reconciliations are late or unsigned
People
- A bookkeeper or manager who never takes leave and will not share duties
- Pressure from owners or lenders to meet a target
- A close relationship with a vendor or customer
- Evasive or inconsistent answers to inquiries
Third parties
- Vendors with a post office box, no phone number or an address matching an employee
- Confirmation replies that arrive through the client
- Customers that dispute balances the client says are good
The ACFE's 2026 Occupational Fraud report lists behavioral red flags with the highest median losses, including excessive pressure from within the organization, past legal problems, unusually close association with a vendor or customer, and refusal to take vacations. Behavioral flags raise risk; they do not prove wrongdoing. See fraud risk factors and the fraud triangle.
Worked example: a net worth analysis
Illustrative numbers. Records of a small company's cash receipts are incomplete, and the owner is suspected of taking unrecorded cash. A net worth analysis measures the change in the owner's wealth and compares it to known income.
| Item | Amount |
|---|---|
| Net worth at end of year (assets $1,150,000 less liabilities $310,000) | $840,000 |
| Net worth at start of year (assets $820,000 less liabilities $330,000) | $490,000 |
| Increase in net worth | $350,000 |
| Add: living expenses (spending that did not build net worth) | $95,000 |
| Income needed to explain the change | $445,000 |
| Less: known income (salary and reported distributions) | $210,000 |
| Unexplained difference | $235,000 |
Check: $840,000 - $490,000 = $350,000; $350,000 + $95,000 = $445,000; $445,000 - $210,000 = $235,000. The difference is a lead, not a finding. Gifts, inheritances, non-taxable proceeds and valuation errors can explain part of it, so the analysis lists and tests each.
Credentials
Practitioners commonly hold the CPA license and one or both of the Certified Fraud Examiner credential from the ACFE and the Certified in Financial Forensics (CFF) credential from the AICPA. See the CFE exam guide and the forensic accountant career guide.
Frequently asked questions
What does a forensic accountant do?
They investigate suspected fraud, trace assets, calculate damages and communicate findings in reports and testimony, usually for attorneys, boards and insurers.
What is the difference between forensic accounting and auditing?
An audit gives reasonable assurance on whether financial statements are materially misstated. Forensic accounting answers a specific question about a suspected loss or dispute, often with full-population testing and evidence handling suited to litigation.
Do forensic accountants need to be CPAs?
No law requires it for investigative work, though many are CPAs. Some roles, such as attest services, require a license. Credentials are a market signal, not a legal requirement.
What is a forensic audit?
The term usually means a forensic examination aimed at finding and quantifying fraud, not an audit under auditing standards. Because the term is loosely used, define it in the engagement letter.
What is predication?
The factual basis that justifies starting a fraud examination.
Sources
- ACFE, Occupational Fraud 2026: A Report to the Nations, acfe.com/report-to-the-nations
- BLS, Occupational Outlook Handbook: Accountants and Auditors, bls.gov/ooh
- AICPA, AU-C 240; Code of Professional Conduct, general standards (ET 1.300.001); Statements on Standards for Consulting Services (CS section 100)
- United States v. Kovel, 296 F.2d 918 (2d Cir. 1961)
- Federal Rule of Evidence 702; Federal Rule of Civil Procedure 26(a)(2), uscourts.gov
Part of CORAA University · Evidence and audit procedures: related guides, calculators and templates.
AU-C references are to AICPA Professional Standards, paraphrased here; read the standard itself before relying on a requirement. This page is guidance, not professional advice. Report an error