Hovland Forensic Financial Logo

Ultimate Guide to Forensic Accounting


This guide is designed for individuals and businesses needing assistance:


forensic accounting

The accounting and finance world can be complex and overwhelming. When possible theft, embezzlement, or economic damages come into play, the complexity grows exponentially. Even seasoned accountants don’t have experience digging into the forensic side of the business.

The first reaction of most who are staring at possible loss from fraud is often to speak with an attorney. This is an important first step.

However, it is only one-half of the equation. An attorney will give legal advice, but for them to properly litigate a case they need independent financial data.

This is where the forensic accountant gets involved with the case.

Forensic Accounting: Table of Contents

Share this guide:

Definition – What is Forensic Accounting?

Forensic accounting is a specialty practice where accounting, auditing and investigative skills are used by an accountant. The forensic accountant provides accounting analysis suitable for use in legal proceedings and to quantify damages related to fraud and embezzlement. The forensic accountant also provides technical assistance in matters involving personal injury, lost wages, business disputes, lost profits, divorce, bankruptcy, and more.

Chapter 1 – Forensic Accountants

Forensic Accountant

Forensic accountants utilize accounting and auditing knowledge to provide litigation support and investigative fraud or embezzlement. Their expertise reviewing internal controls and auditing financial statements make them the ideal professional to investigate financial activities, whether in a business or between individuals.


Forensic accountants usually have a college degree in accounting, economics, or even law. While the breadth of formal education varies, a forensic accountant generally also holds a Certified Public Accountant (CPA) designation. To obtain the CPA designation, an accountant has to take a rigorous 4-part exam that has less than a 50% pass rate.

Additional designations in forensic accounting vary based on the issuing organization. The different forensic accounting designations require about the same amount of fraud training. Below is a list of common forensic accounting designations:

Certified Forensic Accountant (CRFAC) – Issued by the American Board of Forensic Accounting [link]

Certified Fraud Examiner (CFE) – Issued by the Association of Certified Fraud Examiners [link]

Certified in Financial Forensics (CFF) – Issued by the American Institute of Certified Public Accountants [link]

Master Analysist in Financial Forensics (MAFF) – Issued by the National Association of Certified Valuators and Analysts [link]

All of these designations require the accountant to have the financial expertise to investigate fraud.

Prior Experience

Designations demonstrate the competency of a forensic accountant, but how does experience play into the process?

The forensic accountant needs to have experience with internal control. Almost half of all fraud happens because of a breakdown in internal control. The best way to gain experience in internal controls is through a financial statement auditing background.

When performing a financial statement audit, the auditor must analyze internal control. This background is the foundation of a strong forensic accountant.

The forensic accountant also needs to have an advanced level of accounting knowledge. This experience is obtained from working in the accounting field. Specifically, the public accounting arena. The more exposure the accountant has with various accounting software and concepts, the better they will be in analyzing and tracking down fraudulent transactions.

forensic accountant experience

The forensic accountant also develops experience with each case they investigate. The accountant will list out their experience in previous cases in their Curriculum Vitae (CV). This is the professional resume for a forensic accountant.

It should be noted that the forensic accountant can only list out the cases that went to court. Many times cases will settle before court.

When that happens, the forensic accountant can only generically talk about the case and cannot list it on their CV. Most forensic accountants will list out case studies on their website.

While these cases will be written generically, they give an idea as to the types of cases the accountant has investigated that may not be on their CV.

Finally, the forensic accountant also obtains additional experience through their required continuing education. With the forensic accounting designation comes required yearly classes.

These classes help the accountant strengthen their current skills plus add new concepts in detection.


The investigation process is lengthy, but the methodology developed by the Forensic Accounting Academy © is extremely thorough.

Forensic Investigation Methodology

Source: nacva.com/faa

As noted in the above diagram, the investigation process has several steps. Keep this in mind when hiring a forensic accountant.

Forensic Accounting Firm

fractional controller services

Forensic accounting firms specialize in forensic accounting and litigation 

support. Most firms will conduct embezzlement investigation, and some will have a subset specialty in digital forensics. The firms can be astandalone forensic accounting firm, or a department within a larger public accounting practice. As with any profession if a firm specializes in forensic accounting, they will have more experience and knowledge versus a small public accounting practice that is dabbling in the profession.Regardless of the structure, verify the individuals performing the investigation are either certified in forensic accounting or fraud examinations.

Chapter 2 – Investigation Process

Forensic investigation

Who hires forensic accountants?

When fraud has been suspected, the question is, who hires the forensic accountant? Generally, an attorney will hire a forensic accountant.

The attorney will need to be apprised as to how the investigation is going so it makes sense for them to do the hiring. The attorney will also incorporate the investigation results into their case.

The attorney will sometimes hire the forensic accountant as a consultant versus an expert. There are several legal intricacies related to this, but the most generic reason is an expert’s work is subject to review by the opposing side.

The consultant’s work is, to a certain extent, protected. Attorneys will initially engage the forensic accountant as a consultant.

When they determine the forensic accountant will need to testify, then they will change the requirements of the engagement. The attorney will then disclose to the court the identification of the expert.

Conflict of Interest

Before an investigation starts, the forensic accountant will perform a conflict of interest inquiry with all parties involved in the case. It is important that the accountant be independent, as any lack of independence will taint even the best investigation.

The accountant should be independent in fact, no financial or personal relationships, and in appearance, any indirect association.

Engagement Letters

forensic engagement letter

After the conflict of interest has been cleared, the forensic accountant will send out an engagement letter. This letter will clarify what procedures the accountant will perform and the report to be issued.

It is important to note that the accountant will focus strictly on the perceived embezzlement. This is done so all parties are fully aware of what exactly is being completed.

This prevents any assumption on areas the accountant will examine. If additional fraud is discovered, the engagement letter will be amended to disclose the new procedures and tasks to be performed.


The forensic accountant will generally ask for a retainer upfront. The amount of the retainer can vary depending on the amount of information, both historical and volume, the accountant must review. Retainers usually range from $2,000 – $10,000 and above.

Rarely will the accountant be able to quote an exact fee for the investigation—there are too many unknown variables.

The more years the suspected fraud has been covered, the more information the accountant must review. Billings are typically done by the hour, with the set billing rate quoted in the engagement letter.

The actual billing will either happen as the investigation progresses or as the report is issued. Discuss with the forensic accountant how the billings will work and if the project is small or significant. They can usually tell based on initial discussions.

Analyze Data

The forensic accountant will utilize many sources of data, both private and public, as well as many different tools such as data extraction.

At the start of the investigation, the accountant will obtain a large amount of data. As they investigate, they may discover they need more data. This is due to the unknown variables at the beginning of the investigation. Additional requests for more information is common.

data analytics

When analyzing the data, the accountant will utilize multiple tools and techniques. Common tools used range from data extraction software such as Idea to standard Microsoft Access database.

The main criteria in this analysis is the information needs to be in a usable electronic format. If the information is all hard copy and PDF scans, then the investigation will take considerably longer.

Techniques the accountant will utilize range from gap sequencing to Benford’s Law. There are over 100+ techniques available to a forensic accountant.

The techniques used are dependent on the type of fraud being investigated.

Financial Audit Versus Forensic Investigation

It is important to note the main difference between a financial audit and a forensic investigation. A financial audit is concerned about materiality.

Items under a specific dollar amount are ignored due to immateriality.

In a forensic investigation, there are no materiality thresholds. If an amount is suspect, then it is investigated.

A financial audit will issue a set of financial statements. Typically, a balance sheet, income statement, cash flow, and footnotes.

A forensic investigation will issue a report only on the items investigated not a set of financial statements.


Forensic accounting report

A typical forensic report will have 5 main parts:

    • Indication of Information Received – This is a summary of all the information the accountant had access to for the investigation. The importance of this part of the report is it allows legal counsel to cross reference information they have to what was supplied to the accountant.
    • Background of the Case – This will be a short summary of the case and an explanation as to why the case is being investigated. It can be as brief as one paragraph or several pages long. The key is to indicate the reasons why the investigation was deemed necessary
    • Items Investigated – Items investigated will be the core part of the report. The report will detail all items that were examined. This part of the report will contain charts, graphs, and other numerical information. These pages will ultimately support the conclusion.
    • Conclusion – The conclusion will indicate the total dollar amounts, if any, that are suspect. The conclusion will be focusing strictly on the dollar amounts and who the amounts benefited.
    • Exhibits – Exhibits are the supporting documentation for all the key items in the report. Depending on the type of case, the exhibits can represent almost 90% of the total report in terms of pages. The key is that the exhibits should support all numbers in the report, whether the number is a calculation, invoice, or a combination.

Once the report is issued, there can be either a settlement or a trial.


It is not unusual that a settlement to be reached after a forensic investigation. If a settlement is reached, then the respective attorneys will negotiate back and forth on the outcome.

At this point, the forensic accountant will no longer be involved in the case.


If case is to proceed to trial, then various items will be put into motion.

A trial date will be set. The opposing side with hire an expert to rebut the report.

The original expert will possibly rebut the rebuttal report. Then the forensic accountant will testify at trial. See Chapter 7 for a discussion on rebuttals of opposing experts.

Chapter 3 – Embezzlement Investigations


Fraud comes in many forms. For most forensic investigations the type of fraud most often investigated is embezzlement.

Per Merriam-Webster, embezzlement is “to appropriate (something, such as property entrusted to one’s care) fraudulently to one’s own use”.

Embezzlement usually revolves around the theft of cash from a business, estate, or individual.

When investigating embezzlement, the forensic accountant will first get an idea of the internal control weaknesses. As mentioned in Chapter 1, almost half of all fraud happens because of a breakdown in internal controls.

An understanding of the internal controls will assist in identifying the primary suspects and accounts susceptible. Think of this as the low-hanging fruit of an investigation.

Suspects in embezzlement want one particular asset over all others—cash. Because of this, many of the investigation procedures will focus on cash in and cash out of the bank account.

The forensic accountant will always request access to the bank statements, canceled checks, and deposit slips. The reason is accounting records can be manipulated and invoices forged.

However, the original bank statements and the canceled checks will provide support for the flow of funds.

Almost 40% of all occupational fraud is discovered by a tip.

Fraud could happen over several years before being discovered. Because of this, a typical embezzlement case can span several years.

This means that the forensic accountant will need access to the information for all the years possibly affected.

Some historical records won’t be available. Without the records, the forensic accountant cannot investigate. They can only document the years with missing information.

Forensic accountants should never speculate on missing information. All charts, numbers, and calculations in their report should be supported with actual documentation.

Embezzlement investigations are the most performed work of a forensic accountants due to their unique skills and expertise in accounting, auditing, and detection.

Chapter 4 – Divorce

forensic accountant divorce proceedings

An area in that forensic accountants are called upon is divorce proceedings.

High-income couples typically have assets in multiple investments and personally controlled companies. This tends to lead to one of the spouses hiding income or assets from the other spouse.

The accountant will investigate all personally controlled businesses where income could be hidden. The income can be hidden through distributions recorded as company expenses or income that were never recorded in the business.

The key item is at least one spouse needs to have the ability to control all transactions in the company.

In divorce proceedings, one side will usually have control over much of the information. Request for records will have to go from one attorney to the other.

The production of the records tends to take quite a bit of time, even if there are set deadlines.

Hidden income investigations in divorce proceedings tend to extend out over many months. Not because of the difficulty in investigating the transactions, but because the opposing side will delay sending all information requested.

Chapter 5 – Bankruptcy

forensic accountant bankruptcy proceedings

Forensic accountants assist their clients in bankruptcy proceedings through:

  • Developing a plan for bankruptcy and guiding the company out of bankruptcy.
  • Uncovering fraud in bankruptcy.

The forensic accountant has expertise in accounting, auditing, and cash flow management. These areas allow the accountant the ability to help analyze transactions and assist the company in identifying profitable avenues.

They also help in the financial negotiations with the creditors. This is done in conjunction with the bankruptcy attorney.

The accountant will calculate all the necessary amounts for the creditors, and the attorney will negotiate the actual terms of the settlement.

There can be bankruptcy that has occurred due to fraud. The fraud can be all cash siphoned out prior to filing bankruptcy, false statements made to creditors, or false information reported to external entities.

The forensic accountant will investigate the respective source documents related to the possible fraud. The accountant will determine if the fraud ultimately caused the bankruptcy, or if the movement of assets was done to conceal from possible creditors.

The accountant in this situation will be hired by either one of the creditors or, in certain circumstances, the court. No matter who hires them, the forensic accountant will proceed with the investigation like all other investigations.

Chapter 6 – Economic Damages

economic damages

Economic damages are damages that usually involve wrongful death, personal injury, wrongful termination, or lost profits.

Each of these areas revolves around the notion that but for the action(s) of another party, the affected party would be in a different position.

Under economic damages is the concept of ‘but-for’. There are four methods for calculating economic damages under the ‘but-for’ concept.

Generally, these methods focus on:

  • Earnings or net income that occurred prior to the occurrence date.
  • The date on which another party’s actions contributed to a reduction of earnings or net income.
  • Calculation of earnings or net income necessary to make the affected party whole.

The forensic accountant will perform several calculations on the available records to determine the amount of lost earnings or lost profit. The accountant will then calculate the total amount back to the present value amounts.

Lost profit cases tend to revolve around one individual defaming or interfering with another individual’s business. This then leads to the affected party losing revenue, missing out on discounts on product purchases, or keeping qualified employees, etc.

Ultimately, it is suspected that the actions of the offending party have caused the affected party to be financially impacted.

wrongful termination

A wrongful termination case tends to revolve around an employee being terminated and having to find work at lesser pay. It is important that the accountant stay strictly within the financial aspects of the case and not venture into whether the termination was appropriate.

That is for the court or jury to decide.

Regardless of the type of case, the accountant needs to be able to support a future point in time where the affected party is made whole again. This will be a detailed calculation and usually works towards a point in the future.

This future point can be as short as a couple of months or several years. The accountant will need to supply detailed calculations on how they arrived at the future endpoint.

Chapter 7 – Rebuttal of Expert

expert witness

As noted in previous chapters, an expert witness’s report will always be rebutted by the opposing side. The important item to understand in the rebuttal report does the opposing expert refute anything in the original report.

A rebuttal report will usually list out deficiencies or questions the original report did not address. Understanding what the rebuttal report is saying is crucial.

For example, assume an original report indicates the theft of $1,000,000 cash from a company. Now assume the rebuttal report talks about fixed assets and tax returns, but never specially mentions the $1,000,000 in cash. In this situation, the rebuttal expert has not refuted the $1,000,000 of missing cash.

Sometimes the rebuttal report fails to refute the main issue, especially if the evidence clearly shows the occurrence.

A rebuttal report can find flaws in the original expert’s report. A good rebuttal report will bring up questions or note information in the original report that either changes the original expert’s report or completely refutes any or all amounts.

Therefore, it is important that any report, whether it is the original report or a rebuttal report, contains supporting documentation and schedules.

Bonus Chapter – Tips and Recommendations

fraud tips and recommendations

If fraud is suspected:


fractional controller services

Understanding the different aspects of forensic accounting will help individuals and organizations recognize when it is time to bring in an expert.

Approximately one-half of all fraud happens because of weak internal controls.

Consider having a forensic accountant review the internal controls at your organization. A small cost of prevention will guard against the significant cost of an investigation.

Learn More about our Forensic Accounting Services