When a client reports a suspected theft or a staff member raises a concern, the next hours decide whether the evidence survives. A CPA firm that is asked to look into it has to move quickly and still follow a process that will hold up if the matter reaches counsel, an insurer or a court. This article lays out the steps. It assumes the engagement is an investigation in response to concerns of wrongdoing, which AICPA SSFS No. 1 treats as investigation services. See litigation support under SSFS No. 1 for the standard's limits.
First actions
- Involve counsel. If criminal or civil action is possible, an attorney should direct the work so communications and work product are protected as far as the law allows.
- Limit knowledge. Share the concern with as few people as possible. Do not tell the suspected individual.
- Preserve evidence. Secure the accounting system, email, bank access and physical files before access changes. Take backups and record the date and time. Change administrator credentials only under a plan, since a sudden change tells the suspect.
- Stop further loss. Restrict signing authority, payment approvals and system rights in a way that does not tip off the person.
- Check insurance. Review crime or fidelity coverage notice requirements before work begins.
Scoping
Define the questions in writing: what is alleged, over what period, involving which accounts, people and entities. Agree on who the firm reports to, and set a fee basis that does not depend on the result. The scope will change as facts emerge, so build in a checkpoint where it is revisited and re-documented.
Use the fraud triangle as a lens on the facts, since pressure, opportunity and rationalization each point to different evidence. See the glossary entry on fraud triangle. The classification of schemes in the fraud tree helps pick tests, since a payroll scheme, a vendor scheme and a cash scheme leave different traces. The COSO and ACFE Fraud Risk Management Guide, second edition, states that there is no one-size-fits-all approach to managing fraud risk, and the same holds for investigations: test selection follows the scheme.
Evidence
- Forensic copies. Image computers and mailboxes rather than browsing them in place. Browsing changes metadata.
- Original documents. Handle originals as little as possible, keep them in a controlled location and log every transfer.
- Third-party records. Request bank statements, vendor confirmations and cleared check images directly from the source where possible.
- Accounting system logs. Audit trails, user logs and edit histories show who entered and changed entries, and when. See audit trail testing.
- Data analysis. Full-population analysis of payments, journal entries, vendor master changes and payroll changes often finds the pattern. See audit data analytics, journal entry testing and Benford's law.
Interviews
Interview in sequence, from people with general knowledge to people with specific knowledge, and the subject last. Two interviewers attend, one questions and one records. Prepare questions from the documents, begin with open questions and move to specific ones. Do not accuse, threaten or promise leniency. Memorialize each interview in a memo prepared the same day, and have counsel advise on the rules for the jurisdiction, including employee rights. Interview notes are evidence, so keep them with the file.
Quantification
Tracing and loss measurement are the core deliverables:
- Direct tracing. From the bank to the books and the reverse.
- Net worth or lifestyle analysis where cash was taken and not recorded, as counsel directs.
- Extrapolation. If the population is large, use a defined sampling method and state its limits. See audit sampling methods.
- Loss definition. Define what is counted as loss, including direct amounts, related costs and recoveries.
Keep a schedule that ties every figure to a source.
The report
The report states the scope, the procedures performed, the facts found, the amounts and the limitations. SSFS No. 1 prohibits opining on the occurrence of fraud, so the report describes what the evidence shows, may say whether it is consistent with elements of fraud, and leaves the legal conclusion to the trier of fact. Language such as "the records show payments totaling the stated amount to a vendor with no supporting documents" says what the evidence supports without a legal conclusion. Review the draft with counsel, then issue it to the engaging party only.
After the examination
- Control remediation. Report the control failures that enabled the scheme. See segregation of duties and management override of controls.
- Financial statement effect. If the client's statements are audited or reviewed, the loss, recoveries, any related party and disclosure effects need to be communicated to the auditor. See fraud risk assessment under AU-C 240.
- Recovery. Insurance claim documentation, restitution schedules and tax treatment of the loss.
- Retention. Keep the file under counsel's direction.
FAQ
Should the firm confront the suspect?
Not before counsel advises and evidence is secured.
Can the report state that fraud occurred?
SSFS No. 1 prohibits opining on the occurrence of fraud.
Who owns the work product?
The engagement letter should say. When counsel retains the firm, the proceeding's rules usually govern.
CORAA prepares ready-to-review audit files for US CPA firms; see /us.
Sources
- COSO, Fraud Deterrence and the Fraud Risk Management Guide, Second Edition: https://www.coso.org/frauddeterrence
- Georgia Society of CPAs, New AICPA Standards for Forensic Services: What You Need to Know: https://www.gscpa.org/content/Home/News/Professional-News/New-AICPA-Standards-for-Forensic-Services--What-You-Need-to-Know.aspx
- Journal of Accountancy, AICPA forensic accounting standards (September 2019): https://www.journalofaccountancy.com/issues/2019/sep/aicpa-forensic-accounting-standards/
- Mercer Capital, AICPA issues new forensic services standard effective January 1, 2020: https://mercercapital.com/insights/posts/2020/aicpa-issues-new-forensic-services-standard-effective-january-1-2020
Part of CORAA University · Evidence and audit procedures: related guides, calculators and templates.
AU-C references are to AICPA Professional Standards, paraphrased here; read the standard itself before relying on a requirement. This page is guidance, not professional advice. Report an error