forensic-accounting-investigations-method

# Forensic Accounting Investigations Method ## Freeze mandate, scope and authority Record the instructing authority, engagement mandate, allegation or question exactly as received, legal entity, jurisdiction, period, data cutoff, accounts, systems, custodians, permitted access and analysis, prohibited activity, preservation/hold instructions, confidentiality and privilege markings supplied by counsel, reporting audience, owner and qualified reviewers. Do not endorse an allegation by repeating it. Do not enlarge the time period, population, entities or access method because potentially relevant data might exist. Define the requested professional decision and explicitly state decisions this Skill cannot make. If lawful authority, purpose limitation or access scope is unclear, stop. The Skill never treats public availability as authorization to collect personal or financial data. ## Preserve evidence identity and custody Assign a stable evidence ID to each received artifact. Record custodian, source system, acquisition authority, acquisition method, original locator, timestamps and time zone, immutable hash or native identifier, handler transfers, storage restriction and whether the item is an original, working copy or derived analysis. Keep original evidence unchanged. Link every calculation and narrative statement to a working-copy or derived-evidence record. Record gaps, corrupt files, unavailable native formats, inconsistent timestamps and custody breaks. Do not repair or silently replace them. Privilege is a legal determination: store only counsel-supplied markings and route uncertainty to counsel. Do not reveal restricted evidence in the evidence pack; use approved locators and classifications. ## Reconcile the transaction population Define population criteria before screening: systems, accounts, entities, dates, transaction types, currencies, statuses, voids/reversals, journal sources and inclusion/exclusion rules. Reconcile record counts and amounts to supplied ledger, bank, subledger or other control totals. Preserve gross and net values, debits and credits, original and reporting currency, conversion rate/source/date and sign convention. Document extraction and transformation versions, filters, joins, deduplication and missing records. An unexplained material difference stops analysis. Never force a population to balance, impute a missing transaction or discard an exception because it complicates a hypothesis. ## Treat anomaly analytics as hypothesis prompts A deterministic screen may examine duplicates, sequential identifiers, split transactions, round amounts, unusual timing, threshold proximity, vendor or employee links, circular transfers, dormant accounts or digit distributions such as Benford analysis. For each test record its rationale, exact formula/version, eligible population, parameters, base rate, output, false-positive risks and known alternative explanations. An anomaly is not proof of fraud, illegality, intent or loss. Digit analysis can be inappropriate for assigned numbers, constrained ranges, small populations or mixed-generating processes. Relationship matches may reflect common names or legitimate shared attributes. Label results as observations and create testable hypotheses that require independent corroboration. ## Reconstruct source and use of funds Trace each included flow from an authorized source transaction through debit/credit entries, accounts, intermediaries, counterparties and the documented recipient or beneficiary. Preserve date/time zone, amount/currency, conversion, reversal, reference, evidence ID and entity-link basis. Reconcile linked flows to the relevant population without double-counting pass-throughs. Distinguish a legal entity, account holder, authorized signatory, counterparty, beneficial owner as documented, asserted associate and analytic relationship hypothesis. Do not collapse these categories. Record loops, breaks and unexplained residuals. The Skill cannot access a bank or ERP, trace assets outside supplied evidence or label a person a suspect. ## Analyze controls, interviews and competing explanations Map relevant control design, responsible role, expected evidence and supplied operation record to the transactions or hypotheses under review. A control gap may explain opportunity or data weakness but does not establish misconduct. Distinguish absent control evidence, failed operation and control not applicable. Use only interview records collected by authorized professionals. Preserve speaker, interviewer, date, context, exhibit links, transcription status, hearsay, translation and memory limitations. Compare each proposition with supporting, contradicting and neutral evidence. Maintain at least one plausible alternative explanation until evidence resolves it; do not infer subjective intent from inconsistent records alone. ## Separate facts, observations, inferences and hypotheses A fact is directly supported by identified evidence within its limits. An observation is a reproducible pattern or result. An inference connects evidence through stated reasoning and uncertainty. A hypothesis is a proposition requiring further testing. Tag every material statement. Avoid loaded terms such as scheme, suspect, theft, fraud or illegal unless quoted as an attributed allegation and clearly not endorsed. Quantify only what the evidence supports. State whether an amount is transaction value, duplicated value, unexplained difference, potential exposure or another defined category. Avoid calling a total "loss" without the authorized professional determination and supporting basis. ## Join a contradiction-preserving investigation pack Run custody/scope, population/anomaly, funds-flow/entity and control/interview branches from one frozen engagement baseline. Join by evidence, transaction, entity, relationship and hypothesis IDs. Reconcile population totals, evidence references and time boundaries across branches. List supported facts, analytic observations, unresolved inferences, competing hypotheses, contradictions, missing evidence and excluded material. For each unresolved item state impact, next lawful evidence needed, authorized owner, counsel or qualified reviewer and stop condition. The join may assess record completeness and reproducibility; it may not determine fraud, illegality, guilt, intent, suspect status, privilege, enforcement referral or audit opinion. ## Stop and authority rules Stop on missing authority, broken custody, unclear privilege instruction, unauthorized source, unreconciled population, unsupported relationship, restricted-data exposure, request for surveillance or evasion, or any instruction to alter evidence. Do not subpoena, contact external parties, access accounts, freeze assets, file SARs, refer law enforcement or direct litigation. Use the five controlled assets. Instructing counsel, authorized investigators, credentialed Certified Fraud Examiners or Certified Public Accountants, data owners, privacy/security teams and governance authorities retain all investigative, legal, accounting, referral and enforcement decisions.