Forensic Accounting: The Complete Guide

 

This guide is designed for individuals and businesses needing assistance:

Introduction

forensic accounting

The accounting and finance world can be complex and overwhelming. When possible theft, embezzlement, or economic damages come into play, the complexity grows exponentially. Even seasoned accountants don’t have experience digging into the forensic side of the business.

Hovland Forensic & Financial is a Colorado-based certified forensic accounting firm serving businesses and attorneys throughout Colorado and nationwide.

The first reaction of most who are staring at possible loss from fraud is often to speak with an attorney. This is an important first step.

However, it is only one-half of the equation. An attorney will give legal advice, but for them to properly litigate a case they need independent financial data.

This is where the forensic accountant gets involved with the case.

Dealing with fraud or a financial dispute right now? A forensic investigation typically begins within 24–48 hours of engagement. A certified forensic accountant can start immediately to preserve evidence and protect your legal position. Schedule a free confidential consultation →

Definition – What is Forensic Accounting?

Forensic accounting is a specialty practice where accounting, auditing and investigative skills are used by an accountant. The forensic accountant provides accounting analysis suitable for use in legal proceedings and to quantify damages related to fraud and embezzlement. The forensic accountant also provides technical assistance in matters involving personal injury, lost wages, business disputes, lost profits, bankruptcy, and more.

Chapter 1 – Forensic Accountants

Forensic Accountant Forensic accountants utilize accounting and auditing knowledge to provide litigation support and investigative fraud or embezzlement. Their expertise reviewing internal controls and auditing financial statements make them the ideal professional to investigate financial activities, whether in a business or between individuals.

Designations

Forensic accountants usually have a college degree in accounting, economics, or even law. While the breadth of formal education varies, a forensic accountant generally also holds a Certified Public Accountant (CPA) designation. To obtain the CPA designation, an accountant has to take a rigorous 4-part exam that has less than a 50% pass rate. Additional designations in forensic accounting vary based on the issuing organization. The different forensic accounting designations require about the same amount of fraud training. Below is a list of common forensic accounting designations:

Certified Forensic Accountant (CRFAC) – Issued by the American Board of Forensic Accounting [link]

Certified Fraud Examiner (CFE) – Issued by the Association of Certified Fraud Examiners [link]

Certified in Financial Forensics (CFF) – Issued by the American Institute of Certified Public Accountants [link]

Master Analysist in Financial Forensics (MAFF) – Issued by the National Association of Certified Valuators and Analysts [link]

All of these designations require the accountant to have the financial expertise to investigate fraud.

Prior Experience

Designations demonstrate the competency of a forensic accountant, but how does experience play into the process? The forensic accountant needs to have experience with internal control. Almost half of all fraud happens because of a breakdown in internal control. The best way to gain experience in internal controls is through a financial statement auditing background. When performing a financial statement audit, the auditor must analyze internal control. This background is the foundation of a strong forensic accountant. The forensic accountant also needs to have an advanced level of accounting knowledge. This experience is obtained from working in the accounting field. Specifically, the public accounting arena. The more exposure the accountant has with various accounting software and concepts, the better they will be in analyzing and tracking down fraudulent transactions. forensic accountant experience The forensic accountant also develops experience with each case they investigate. The accountant will list out their experience in previous cases in their Curriculum Vitae (CV). This is the professional resume for a forensic accountant. It should be noted that the forensic accountant can only list out the cases that went to court. Many times cases will settle before court. When that happens, the forensic accountant can only generically talk about the case and cannot list it on their CV. Most forensic accountants will list out case studies on their website. While these cases will be written generically, they give an idea as to the types of cases the accountant has investigated that may not be on their CV. Finally, the forensic accountant also obtains additional experience through their required continuing education. With the forensic accounting designation comes required yearly classes. These classes help the accountant strengthen their current skills plus add new concepts in detection.

Investigation

The investigation process is lengthy, but the methodology developed by the Forensic Accounting Academy © is extremely thorough. Forensic Investigation Methodology Source: nacva.com/faa As noted in the above diagram, the investigation process has several steps. Keep this in mind when hiring a forensic accountant.

Forensic Accounting Firm

fractional controller services Forensic accounting firms specialize in forensic accounting and litigation support. Most firms will conduct embezzlement investigation, and some will have a subset specialty in digital forensics. The firms can be astandalone forensic accounting firm, or a department within a larger public accounting practice. As with any profession if a firm specializes in forensic accounting, they will have more experience and knowledge versus a small public accounting practice that is dabbling in the profession.Regardless of the structure, verify the individuals performing the investigation are either certified in forensic accounting or fraud examinations.

Chapter 2 – Investigation Process

Forensic investigation

Who hires forensic accountants?

When fraud has been suspected, the question is, who hires the forensic accountant? Generally, an attorney will hire a forensic accountant. The attorney will need to be apprised as to how the investigation is going so it makes sense for them to do the hiring. The attorney will also incorporate the investigation results into their case. The attorney will sometimes hire the forensic accountant as a consultant versus an expert. There are several legal intricacies related to this, but the most generic reason is an expert’s work is subject to review by the opposing side. The consultant’s work is, to a certain extent, protected. Attorneys will initially engage the forensic accountant as a consultant. When they determine the forensic accountant will need to testify, then they will change the requirements of the engagement. The attorney will then disclose to the court the identification of the expert.

Conflict of Interest

Before an investigation starts, the forensic accountant will perform a conflict of interest inquiry with all parties involved in the case. It is important that the accountant be independent, as any lack of independence will taint even the best investigation. The accountant should be independent in fact, no financial or personal relationships, and in appearance, any indirect association.

Engagement Letters

forensic engagement letter After the conflict of interest has been cleared, the forensic accountant will send out an engagement letter. This letter will clarify what procedures the accountant will perform and the report to be issued. It is important to note that the accountant will focus strictly on the perceived embezzlement. This is done so all parties are fully aware of what exactly is being completed. This prevents any assumption on areas the accountant will examine. If additional fraud is discovered, the engagement letter will be amended to disclose the new procedures and tasks to be performed.

Billing

The forensic accountant will generally ask for a retainer upfront. The amount of the retainer can vary depending on the amount of information, both historical and volume, the accountant must review. Retainers usually range from $2,000 – $10,000 and above. Rarely will the accountant be able to quote an exact fee for the investigation—there are too many unknown variables. The more years the suspected fraud has been covered, the more information the accountant must review. Billings are typically done by the hour, with the set billing rate quoted in the engagement letter. The actual billing will either happen as the investigation progresses or as the report is issued. Discuss with the forensic accountant how the billings will work and if the project is small or significant. They can usually tell based on initial discussions.

How Much Is a Forensic Accountant?

Forensic accounting rates in Colorado and nationwide typically range from $250 to $600+ per hour depending on the firm size, the credentials of the person actually doing the work, and the complexity of the engagement. Hovland Forensic & Financial bills a transparent flat rate of $250 per hour for all services with no retainer surprises.

Case Type Typical Total Cost
Simple embezzlement review (1 year, single account) $2,500 to $5,000
Mid-range fraud investigation (2 to 4 years, multiple accounts) $5,000 to $15,000
Complex multi-party litigation support $15,000 and above
Expert witness rebuttal report $2,500 to $7,500
Deposition or trial testimony $250/hour plus travel at actual cost

For a full breakdown of what drives investigation costs and how to estimate your specific case, see our complete Forensic Audit Cost guide.

Analyze Data

The forensic accountant will utilize many sources of data, both private and public, as well as many different tools such as data extraction. At the start of the investigation, the accountant will obtain a large amount of data. As they investigate, they may discover they need more data. This is due to the unknown variables at the beginning of the investigation. Additional requests for more information is common. data analytics When analyzing the data, the accountant will utilize multiple tools and techniques. Common tools used range from data extraction software such as Idea to standard Microsoft Access database. The main criteria in this analysis is the information needs to be in a usable electronic format. If the information is all hard copy and PDF scans, then the investigation will take considerably longer. Techniques the accountant will utilize range from gap sequencing to Benford’s Law. There are over 100+ techniques available to a forensic accountant. The techniques used are dependent on the type of fraud being investigated.

Financial Audit Versus Forensic Investigation

It is important to note the main difference between a financial audit and a forensic investigation. A financial audit is concerned about materiality. Items under a specific dollar amount are ignored due to immateriality. In a forensic investigation, there are no materiality thresholds. If an amount is suspect, then it is investigated. A financial audit will issue a set of financial statements. Typically, a balance sheet, income statement, cash flow, and footnotes. A forensic investigation will issue a report only on the items investigated not a set of financial statements.

Reporting

Forensic accounting report A typical forensic report will have 5 main parts:
    • Indication of Information Received – This is a summary of all the information the accountant had access to for the investigation. The importance of this part of the report is it allows legal counsel to cross reference information they have to what was supplied to the accountant.
    • Background of the Case – This will be a short summary of the case and an explanation as to why the case is being investigated. It can be as brief as one paragraph or several pages long. The key is to indicate the reasons why the investigation was deemed necessary
    • Items Investigated – Items investigated will be the core part of the report. The report will detail all items that were examined. This part of the report will contain charts, graphs, and other numerical information. These pages will ultimately support the conclusion.
    • Conclusion – The conclusion will indicate the total dollar amounts, if any, that are suspect. The conclusion will be focusing strictly on the dollar amounts and who the amounts benefited.
    • Exhibits – Exhibits are the supporting documentation for all the key items in the report. Depending on the type of case, the exhibits can represent almost 90% of the total report in terms of pages. The key is that the exhibits should support all numbers in the report, whether the number is a calculation, invoice, or a combination.
Once the report is issued, there can be either a settlement or a trial.

Settlement

It is not unusual that a settlement to be reached after a forensic investigation. If a settlement is reached, then the respective attorneys will negotiate back and forth on the outcome. At this point, the forensic accountant will no longer be involved in the case.

Trial

If case is to proceed to trial, then various items will be put into motion. A trial date will be set. The opposing side with hire an expert to rebut the report. The original expert will possibly rebut the rebuttal report. Then the forensic accountant will testify at trial. See Chapter 7 for a discussion on rebuttals of opposing experts.

Dealing with a fraud situation in Colorado? Get a free confidential consultation →

Chapter 3 – Embezzlement Investigations

embezzlement Fraud comes in many forms. For most forensic investigations the type of fraud most often investigated is embezzlement. Per Merriam-Webster, embezzlement is “to appropriate (something, such as property entrusted to one’s care) fraudulently to one’s own use”. Embezzlement usually revolves around the theft of cash from a business, estate, or individual. When investigating embezzlement, the forensic accountant will first get an idea of the internal control weaknesses. As mentioned in Chapter 1, almost half of all fraud happens because of a breakdown in internal controls. An understanding of the internal controls will assist in identifying the primary suspects and accounts susceptible. Think of this as the low-hanging fruit of an investigation. Suspects in embezzlement want one particular asset over all others—cash. Because of this, many of the investigation procedures will focus on cash in and cash out of the bank account. The forensic accountant will always request access to the bank statements, canceled checks, and deposit slips. The reason is accounting records can be manipulated and invoices forged. However, the original bank statements and the canceled checks will provide support for the flow of funds. Almost 40% of all occupational fraud is discovered by a tip. Fraud could happen over several years before being discovered. Because of this, a typical embezzlement case can span several years. This means that the forensic accountant will need access to the information for all the years possibly affected. Some historical records won’t be available. Without the records, the forensic accountant cannot investigate. They can only document the years with missing information. Forensic accountants should never speculate on missing information. All charts, numbers, and calculations in their report should be supported with actual documentation. Embezzlement investigations are the most performed work of a forensic accountants due to their unique skills and expertise in accounting, auditing, and detection.

Dealing with a fraud situation in Colorado? Get a free confidential consultation →

Chapter 4 – Asset Misappropriation

Asset misappropriation is the most common form of occupational fraud and covers a broader range of schemes than embezzlement alone. While Chapter 3 focused specifically on the theft of cash, asset misappropriation encompasses any fraud where an employee misuses or steals company resources for personal gain, whether that is cash, inventory, equipment, or even company time.

According to the Association of Certified Fraud Examiners (ACFE), asset misappropriation accounts for the overwhelming majority of occupational fraud cases worldwide. Despite being the most common form of fraud, it is also one of the most preventable when the right internal controls are in place.

For Colorado businesses, understanding the different types of asset misappropriation and the warning signs associated with each is the first step toward protecting company assets.


Types of Asset Misappropriation

Payroll Fraud

Payroll fraud occurs when an employee manipulates the payroll system for unauthorized financial gain. Common payroll schemes include ghost employees (fictitious workers added to the payroll whose paychecks are redirected to the fraudster), falsified hours, unauthorized pay rate increases, and continued payroll payments to terminated employees.

Payroll fraud is particularly difficult to detect in small businesses where a single employee controls both the payroll processing and the bank reconciliation. Separation of duties is the most effective control against payroll fraud.

Expense Reimbursement Schemes

Expense reimbursement fraud involves employees submitting false or inflated expense reports for personal reimbursement. Common schemes include fictitious expense claims, inflated receipts, duplicate submissions of the same expense, and personal purchases billed to the company as business expenses.

This type of fraud is often dismissed as minor due to the relatively small dollar amounts per transaction. However, expense reimbursement schemes frequently go undetected for years, and the cumulative losses can be substantial.

Inventory Theft

Inventory theft involves the unauthorized taking of company product, equipment, or supplies for personal use or resale. Schemes range from straightforward physical theft to more sophisticated approaches such as falsified inventory counts, off-the-books sales where cash is pocketed rather than recorded, and fictitious write-offs used to conceal missing inventory.

Inventory theft is most common in businesses with large physical inventories and limited oversight of warehouse or storage operations. Regular independent inventory counts and reconciliation to sales records are critical controls.

Vendor and Billing Schemes

Vendor fraud involves the manipulation of the accounts payable process for unauthorized payments. Common schemes include fictitious vendor invoices (where payments are directed to a shell company controlled by the employee), overbilling by a real vendor in exchange for kickbacks, and the approval of duplicate invoices for the same goods or services.

Billing schemes tend to produce the largest individual losses of any asset misappropriation category. A forensic accountant will scrutinize vendor lists, payment histories, and vendor setup documentation when investigating suspected billing fraud.


Red Flags of Asset Misappropriation

Recognizing the warning signs of asset misappropriation early can significantly limit financial losses. The following red flags should prompt further investigation:

  • Employees living beyond their apparent means: unexplained lifestyle upgrades, luxury vehicles, or expensive vacations inconsistent with known salary
  • Reluctance to take vacation or share job duties: fraudsters often avoid time away from the office to prevent their schemes from being discovered by a temporary replacement
  • Unusual vendor relationships: vendors with no physical address, vendors sharing an address or phone number with an employee, or vendors added to the system by a single employee without proper authorization
  • Missing, altered, or photocopied documents: original invoices replaced with copies, altered check amounts, or gaps in document sequences
  • Discrepancies between physical inventory and recorded inventory: unexplained shrinkage, frequent write-offs, or inventory counts that consistently differ from system records
  • Complaints from customers or vendors: reports of missing payments, duplicate charges, or unrecognized transactions can indicate internal manipulation
  • Employee reluctance to allow oversight: resistance to audits, reviews, or questions about specific transactions

No single red flag confirms fraud. However, when multiple warning signs appear together, a forensic investigation is warranted.


How a Forensic Accountant Investigates Asset Misappropriation

The investigation of asset misappropriation follows the same structured methodology outlined in Chapter 2, with specific procedures tailored to the type of fraud suspected.

For payroll fraud, the forensic accountant will reconcile payroll records to personnel files, verify the existence of all employees, and trace payroll disbursements to confirmed bank accounts.

For expense reimbursement fraud, the accountant will review submitted expense reports against supporting receipts, cross-reference submission dates and amounts for duplicates, and compare claimed business expenses against company policy.

For inventory theft, the accountant will perform or review independent physical inventory counts, reconcile inventory records to purchase orders and sales records, and analyze write-off patterns for anomalies.

For vendor and billing schemes, the accountant will analyze the vendor master list for suspicious entries, review payment approval workflows, trace disbursements to confirmed legitimate vendors, and examine any vendors added or modified by employees with payment authority.

In all cases, the forensic accountant will document findings in a court-ready report supported by exhibits, following the same reporting structure described in Chapter 2.


Preventing Asset Misappropriation

Prevention is significantly less costly than investigation. The following controls reduce the risk of asset misappropriation in any organization:

  • Separation of duties: no single employee should control an entire financial process from initiation to approval to reconciliation
  • Mandatory vacation policies: requiring employees to take uninterrupted time away from the office allows temporary replacements to identify irregularities
  • Independent reconciliations: bank statements, payroll records, and inventory counts should be reviewed by someone independent of the employee responsible for processing
  • Anonymous reporting mechanisms: a tip hotline or anonymous reporting system allows employees to report suspected fraud without fear of retaliation. The ACFE reports that tips are the most common method of fraud detection.
  • Regular forensic reviews: periodic reviews by an independent forensic accountant can identify control weaknesses before they are exploited

If you suspect asset misappropriation within your Colorado business or need a forensic accountant to support litigation involving fraud claims, Hovland Forensic & Financial provides confidential investigations and court-ready reports for clients throughout Colorado, including Denver, Colorado Springs, Fort Collins, Boulder, Pueblo, and Grand Junction, as well as clients nationwide.

Schedule a Free Confidential Consultation →

Chapter 5 – Bankruptcy

forensic accountant bankruptcy proceedings Forensic accountants assist their clients in bankruptcy proceedings through:
  • Developing a plan for bankruptcy and guiding the company out of bankruptcy.
  • Uncovering fraud in bankruptcy.
The forensic accountant has expertise in accounting, auditing, and cash flow management. These areas allow the accountant the ability to help analyze transactions and assist the company in identifying profitable avenues. They also help in the financial negotiations with the creditors. This is done in conjunction with the bankruptcy attorney. The accountant will calculate all the necessary amounts for the creditors, and the attorney will negotiate the actual terms of the settlement. There can be bankruptcy that has occurred due to fraud. The fraud can be all cash siphoned out prior to filing bankruptcy, false statements made to creditors, or false information reported to external entities. The forensic accountant will investigate the respective source documents related to the possible fraud. The accountant will determine if the fraud ultimately caused the bankruptcy, or if the movement of assets was done to conceal from possible creditors. The accountant in this situation will be hired by either one of the creditors or, in certain circumstances, the court. No matter who hires them, the forensic accountant will proceed with the investigation like all other investigations.

Chapter 6 – Economic Damages

economic damages Economic damages are damages that usually involve wrongful death, personal injury, wrongful termination, or lost profits. Each of these areas revolves around the notion that but for the action(s) of another party, the affected party would be in a different position. Under economic damages is the concept of ‘but-for’. There are four methods for calculating economic damages under the ‘but-for’ concept. Generally, these methods focus on:
  • Earnings or net income that occurred prior to the occurrence date.
  • The date on which another party’s actions contributed to a reduction of earnings or net income.
  • Calculation of earnings or net income necessary to make the affected party whole.
The forensic accountant will perform several calculations on the available records to determine the amount of lost earnings or lost profit. The accountant will then calculate the total amount back to the present value amounts. Lost profit cases tend to revolve around one individual defaming or interfering with another individual’s business. This then leads to the affected party losing revenue, missing out on discounts on product purchases, or keeping qualified employees, etc. Ultimately, it is suspected that the actions of the offending party have caused the affected party to be financially impacted. wrongful termination A wrongful termination case tends to revolve around an employee being terminated and having to find work at lesser pay. It is important that the accountant stay strictly within the financial aspects of the case and not venture into whether the termination was appropriate. That is for the court or jury to decide. Regardless of the type of case, the accountant needs to be able to support a future point in time where the affected party is made whole again. This will be a detailed calculation and usually works towards a point in the future. This future point can be as short as a couple of months or several years. The accountant will need to supply detailed calculations on how they arrived at the future endpoint.

Chapter 7 – Rebuttal of Expert

expert witness As noted in previous chapters, an expert witness’s report will always be rebutted by the opposing side. The important item to understand in the rebuttal report does the opposing expert refute anything in the original report. A rebuttal report will usually list out deficiencies or questions the original report did not address. Understanding what the rebuttal report is saying is crucial. For example, assume an original report indicates the theft of $1,000,000 cash from a company. Now assume the rebuttal report talks about fixed assets and tax returns, but never specially mentions the $1,000,000 in cash. In this situation, the rebuttal expert has not refuted the $1,000,000 of missing cash. Sometimes the rebuttal report fails to refute the main issue, especially if the evidence clearly shows the occurrence. A rebuttal report can find flaws in the original expert’s report. A good rebuttal report will bring up questions or note information in the original report that either changes the original expert’s report or completely refutes any or all amounts. Therefore, it is important that any report, whether it is the original report or a rebuttal report, contains supporting documentation and schedules.

What Makes a Strong Rebuttal Report

A strong rebuttal report does more than list disagreements with the original expert’s conclusions. It systematically addresses each material finding, identifies the specific methodological or factual basis for the disagreement, and provides alternative calculations where appropriate.

The most effective rebuttal reports share four characteristics:

Specificity. A rebuttal that says an expert’s methodology was flawed without identifying exactly which calculation was flawed and why carries little weight with a court. Every criticism in a rebuttal report should be tied to a specific number, assumption, or methodology.

Alternative calculations. Where the original expert’s figures are disputed, a strong rebuttal does not simply argue the number is wrong — it provides the correct calculation with supporting documentation. This gives the court something concrete to consider rather than competing assertions.

Source documentation. Every alternative figure in a rebuttal report should be traceable to source documents. The same standard that applies to the original report applies equally to the rebuttal.

Daubert readiness. Rebuttal testimony is subject to the same Daubert standards as original expert testimony. A rebuttal report built on sound methodology, reliable data, and defensible calculations is significantly harder to exclude than one built on opinion alone.

When to Hire a Rebuttal Expert

Attorneys should retain a rebuttal forensic accountant as early as possible after the opposing expert’s report is received. Rebuttal reports take time to prepare properly and court deadlines for rebuttal disclosures are typically tight.

The earlier a rebuttal expert can review the original report, the more thoroughly they can identify weaknesses, request additional discovery if needed, and prepare a report that gives litigation counsel the best possible foundation for cross-examination.

Hovland Forensic & Financial provides rebuttal expert witness services for Colorado attorneys and counsel nationwide. Our rebuttal reports have a zero Daubert challenge record. Learn more about our expert rebuttal services →

Dealing with a fraud situation in Colorado? Get a free confidential consultation →

Bonus Chapter – Tips and Recommendations

fraud tips and recommendations If fraud is suspected:

Conclusion

fractional controller services

Understanding the different aspects of forensic accounting will help individuals and organizations recognize when it is time to bring in an expert.

Approximately one-half of all fraud happens because of weak internal controls.

Consider having a forensic accountant review the internal controls at your organization. A small cost of prevention will guard against the significant cost of an investigation.

Hovland Forensic & Financial provides forensic accounting investigations, expert witness testimony, and litigation support for businesses and attorneys throughout Colorado, including Denver, Colorado Springs, Fort Collins, Boulder, Pueblo, and Grand Junction, as well as clients nationwide.

What is forensic accounting?

Forensic accounting is a specialized field where accounting skills are used to investigate financial fraud, analyze disputes, or provide expert evidence in court cases.

What types of cases need a forensic accountant?

Forensic accountants are called for fraud investigations, divorce or estate disputes, business partner conflicts, economic damages claims, insurance matters, and more.

Can a forensic accountant testify in court?

Yes. Forensic accountants frequently serve as expert witnesses in trials, depositions, and arbitrations, presenting their findings and opinions.

How does forensic accounting differ from regular accounting?

While traditional accountants focus on compliance or everyday financial management, forensic accountants specialize in detection, investigation, and documentation of financial misconduct or irregularities.

What qualifications does a forensic accountant need?

Most have accounting and auditing backgrounds, specialized training in investigation or litigation, and certifications like CPA, CFF (Certified in Financial Forensics), or CFE (Certified Fraud Examiner).

How can I get started if I suspect fraud in my business or case?

Contact Hovland Forensic & Financial for a confidential, no-cost initial consultation. We’ll outline next steps and how forensic accounting can help your situation.

Ready to speak with a Colorado forensic accountant? Hovland Forensic & Financial offers a free confidential consultation for businesses and attorneys throughout Colorado and nationwide. Schedule your free consultation →