How Do You Plan a Forensic Audit Engagement to Find Financial Discrepancies?

What a Forensic Audit Engagement Actually Is

A forensic audit engagement is an investigation designed to identify, explain, and sometimes quantify financial discrepancies that may be concealed, misclassified, omitted, or obscured by weak controls. It differs from a conventional financial statement audit because the objective is not primarily an opinion on whether financial statements comply with a reporting framework. Instead, the engagement usually follows a suspected transaction, account balance, vendor, payroll process, asset, contract, or allegation, with evidence collected to determine what happened and why. The work is also called forensic accounting, forensic accountancy, or investigative auditing, although not every forensic assignment meets the legal or evidentiary standard associated with expert testimony. By 1 October 2026, organizations commonly request this work after unexplained cash shortages, duplicate payments, payroll anomalies, related-party transactions, procurement concerns, or internal-control failures. The engagement should have a written scope, defined evidence period, named decision-maker, reporting format, and explicit limitation on whether the auditor is being asked to investigate misconduct, recover money, support litigation, or improve controls.

Also worth reading: How Do You Choose a Financial Auditor and Detect Discrepancies in 2026? · How Do Auditors Test Financial Close Controls Without Missing Hidden Discrepancies? · What Are the Best AP Control Testing Steps for Detecting Financial Discrepancies?

The term can be used too broadly. An accountant reconciling a bank account is performing a limited procedure, while a team tracing funds through multiple entities and testing whether management concealed them is conducting a more developed forensic audit. A credible engagement bridges accounting, internal controls, interviews, electronic evidence, and legal issue identification. It does not assume fraud merely because a discrepancy exists, nor does it promise that every irregular transaction constitutes a crime. That distinction matters because financial irregularities may result from timing differences, incorrect cutoffs, poor documentation, unauthorized system access, conflicts of interest, collusion, or simple human error. A properly planned investigation tests competing explanations before reaching conclusions.

Forensic work has historical roots extending through the British Post Office scandal, where contractual arrangements, internal and external audit, technical competence, stakeholder engagement, oversight, and whistleblowing became central issue areas. International Standards on Auditing, including standards concerning materiality and the auditor’s work, can provide useful discipline, but forensic investigations may also be governed by professional rules, court orders, regulatory requirements, and the law of the relevant jurisdiction. The planning memorandum should state which standards apply rather than implying that an ordinary audit opinion and a fraud investigation are interchangeable. This is especially important when the client expects a report suitable for a board, prosecutor, regulator, insurer, or court.

A useful working definition is: a forensic audit is a focused, evidence-based examination of financial activity in which the auditor seeks to identify discrepancies, reconstruct events, evaluate control failures, and document findings at the level of support required by the intended user. This definition keeps the engagement narrower than a full enterprise forensic examination while making clear that simple reconciliation alone may be insufficient. It also establishes the correct tone: skepticism supported by procedure, not accusation unsupported by facts. The final report should separate verified facts, arithmetic explanations, unresolved questions, and recommended actions.

How to Define the Scope Before Work Starts

The first planning decision is to identify the specific allegation or risk. “Review the finance department” is not a workable scope because it is too broad, while “trace all payments to Vendor X from 1 January 2024 through 30 September 2024 and test whether duplicate invoices were paid” is testable. The period should reflect the period in which the suspected events occurred, although later periods may need review to determine whether corrections were posted or the conduct continued. If management claims that an issue was resolved in 2025, evidence from 2026 may still be relevant. A 36-month period may be justified for payroll, procurement, or long-term contract testing, but a longer period is not automatically more rigorous; it increases cost and can dilute the investigation.

The scope must also name the accounts, transactions, entities, systems, locations, and people involved. For example, it could cover general ledger entries, bank statements, purchase orders, receiving records, invoices, payroll registers, timesheets, contractor agreements, minutes, email metadata, and access logs. The auditor should distinguish records the client can provide from information that must be obtained independently from banks, payment processors, tax agencies, vendors, or cloud-system providers. A request for all company records does not guarantee that the client possesses complete data, so preservation and chain-of-custody procedures may be necessary. If relevant, the engagement should address whether personal devices, messaging applications, or third-party platforms contain business records.

A written deliverable specification prevents accidental disagreement over what the client will receive. Options include a factual findings report, a control-deficiency report, a loss-estimation report, a litigation-support report, or a combination, with each format carrying different assurance and risk. The report might summarize tested populations, describe exceptions, quantify supported discrepancies, explain control weaknesses, and recommend corrective measures, but it should not overstate conclusions that the available evidence cannot support. The auditor should state sampling limitations, reliance on management representations, unresolved records, and departures from the requested scope. Those disclosures are not admissions of weakness; they are necessary boundaries that help the reader use the report responsibly.

The engagement letter should also establish authority, confidentiality, privilege expectations, retention requirements, access to personnel, communication protocols, and whether the team may contact third parties. The client should provide a designated sponsor with authority to answer questions and receive findings, but management should not be allowed to interfere with the auditor’s judgment. If allegations involve senior executives, the audit committee or board may need to oversee the process. Where criminal or regulatory exposure is possible, counsel should be involved before interviews, document demands, or evidence handling that could create legal risk.

Building the Evidence and Data Plan

A forensic audit becomes reliable when the auditor can connect a suspected discrepancy to source records and then connect those records to the accounting treatment. For a payment investigation, the chain might run from a purchase order to an invoice, receiving evidence, approval, journal entry, bank payment, and any subsequent adjustment. For payroll, it might connect employee master data, time records, approved pay rates, gross-to-net calculations, bank accounts, and tax filings. For cash, the auditor may use bank reconciliations, independent bank confirmations, point-of-sale data, deposit records, surveillance records where legally available, and interviews. A general ledger review alone is usually insufficient because entries can be arithmetically correct while lacking an economic event.

Data integrity should be established before analysis begins. The engagement team should obtain native exports when possible rather than screenshots, preserve file names and dates, record the source and method of extraction, and work from read-only copies where practicable. Spreadsheet formulas, accounting-system audit trails, access permissions, and version histories can show whether records were altered after the fact. The auditor should document failed or incomplete requests rather than quietly excluding them from the population. If millions of transactions exist, sampling may be appropriate for a control assessment, but targeted testing is usually necessary for the specific accounts or vendors under investigation.

Electronic evidence requires careful treatment. A deleted email does not necessarily prove deletion if it remains on a server or backup, while an email that appears authentic may still require header, metadata, or custodian verification. Mobile-device and messaging evidence raises additional questions about ownership, consent, privacy, and applicable legal process. The audit plan should identify who will collect each source, what tools will be used, how hashes or audit logs will be retained, and when a second person should verify high-impact extractions. A chain-of-custody log is particularly valuable if allegations may lead to litigation or regulatory action, although routine audits do not always need courtroom-grade procedures.

The team should reconcile the data populations before drawing conclusions. Transaction totals should be tied to general-ledger balances, bank statements, subsidiary records, and approved control totals, with differences investigated rather than treated as rounding. Duplicates should be tested for identical fields without assuming that two similar payments are duplicates; a recurring subscription or split shipment can be legitimate. Missing invoices may reflect lost paperwork rather than fictitious expenditure, and unusual payments may be explained by business emergencies. The strongest findings generally link multiple independent evidence types, such as a payment record, approval trail, bank destination, interview testimony, and subsequent concealment or correction.

Procedures Used to Find and Explain Discrepancies

The audit team should begin with analytical review, then move to transaction-level testing. Analytical procedures may include monthly trend analysis, vendor concentration, round-dollar payments, weekend or after-hours entries, unusual users, journal entries near period-end, duplicate invoice numbers, payroll changes, negative adjustments, and payments to addresses related to employees. Thresholds should be tailored rather than mechanical. For example, an organization might initially flag payments above $10,000, but that threshold would miss numerous small duplicate invoices; conversely, reviewing every $25 expense may be wasteful. Multiple thresholds can combine absolute size, percentage deviation, unusual behavior, and conflict indicators.

Substantive procedures should test existence, occurrence, authorization, accuracy, cutoff, classification, and completeness as relevant to the issue. Existence testing asks whether the recorded item really occurred, while occurrence and authorization ask who initiated it and whether it was approved. Cutoff testing determines whether transactions were recorded in the correct accounting period, and classification testing checks whether expenses, assets, liabilities, and equity were recorded appropriately. A missing receiving report does not automatically mean goods were not received, but it may indicate a control deficiency requiring corroboration. Interview evidence should be used to explain exceptions, not to replace documents that should ordinarily exist.

Red flags become findings only after corroboration. Common red flags include journal entries posted by users outside finance, bank accounts changed close to payroll, invoices with sequential or copied numbers, repeated payments after a “failed” transaction, unsupported manual adjustments, vendor addresses matching employees, and reports produced only after an allegation arose. The auditor should also test whether management supplied complete populations and whether the audit trail has gaps. In a procurement investigation, for example, split purchases below a $50,000 approval threshold might collectively total $195,000 and therefore require escalation even though no individual payment crossed the threshold. The significance of a discrepancy depends on both magnitude and context.

Fraud-risk procedures may include surprise confirmation of selected balances or counterparties, independent contact with vendors, examination of system logs, and comparison of approved budgets with actual expenditure. The auditor should be aware that confirmation requests can tip off a party involved in suspected misconduct, so timing and authorization matter. When facts remain unresolved, the conclusion should be precise: “The records do not establish whether the $84,000 payment represented a valid advance.” A report should avoid converting uncertainty into a definitive allegation. Clear qualification preserves credibility and helps the decision-maker choose an appropriate response.

Comparing Forensic Audits with Other Review Options

A forensic audit is one of several possible responses to a financial concern. The right choice depends on whether the objective is assurance, control evaluation, recovery, legal support, transaction testing, or operational improvement. Selecting a more expensive investigation for a narrow reconciliation issue wastes resources, while choosing a limited review for suspected collusion may produce false reassurance. The comparison should consider depth, independence, legal capability, cost, and whether the suspected issue is financial, operational, or primarily a matter of employee conduct.

These options can overlap, but they should not be treated as substitutes. A clean financial statement audit does not mean that no fraud occurred, because an audit uses materiality, professional judgment, and risk-based testing rather than a guarantee of detecting every deception. Conversely, a forensic investigation that confirms a control weakness does not automatically establish a material misstatement. If a client needs both assurance and investigation, separate workstreams or a clearly coordinated plan may be appropriate. Before engaging a firm, ask whether the proposed team has experience with the relevant industry, jurisdiction, systems, and type of allegation, rather than relying only on a generic “forensic services” label.

Common Mistakes That Weaken an Engagement

The most damaging planning error is beginning with a preferred conclusion. If the sponsor describes a named employee as responsible before testing, the investigation can become confirmation-driven, and the final report may lose credibility with boards, regulators, or courts. The sponsor’s concern should be recorded, but the scope should remain open to innocent explanations and alternative suspects. Another common mistake is treating every unusual item as fraud without identifying the expected accounting treatment. A $60,000 payment to a vendor may be ordinary in one industry and exceptional in another; benchmarks should be based on the client’s size, contracts, and risk profile.

Poor population definition is equally problematic. Testing a few transactions selected by the person under investigation may create bias, while reviewing only a small number of high-dollar payments may miss a pattern of smaller losses. The auditor should document how the population was obtained, whether it reconciles to the ledger, and why the sample was selected. Management-provided spreadsheets can omit accounts, hide deleted rows, or contain unsupported summaries. Independent extraction and reconciliation help, but they do not replace an assessment of whether the underlying system’s records are complete.

Other mistakes include starting interviews before collecting documents, failing to preserve electronic evidence, using a generic report for a litigation-sensitive matter, and postponing control recommendations until the investigation ends. An interview may produce useful leads, but witnesses can change explanations once they know the specific issue. The team should establish a factual chronology, ask neutral and open questions, record responses accurately, and corroborate statements. If misconduct is suspected, counsel may advise the client about employment rights, privilege, notification duties, and restrictions on contact with third parties.

Finally, the client should not confuse a forensic report with a guarantee of recovery. Investigators can identify unsupported payments, quantify losses supported by evidence, and recommend suspension of risky activity, but collecting money depends on assets, jurisdiction, insurance, cooperation, and legal proceedings. Some engagements also fail because no one owns remediation. The engagement plan should assign responsibility, deadlines, required evidence of completion, and a follow-up review. A 90-day remediation check can be useful for urgent control issues, while complex procurement or payroll remediation may need 180 or 365 days. The appropriate interval depends on the risk, not on a standard marketing promise.

Timing, Costs, and Practical Engagement Steps

For a focused forensic audit, a practical first phase may take 5 to 10 business days to clarify the allegation, preserve records, define populations, and conduct initial interviews. Detailed testing commonly takes another 3 to 8 weeks, depending on transaction volume, data quality, system access, third-party responses, and management cooperation. A report may follow within 1 to 3 weeks, while litigation support or a large multi-entity investigation can extend the timetable substantially. If evidence is withheld or an auditor discovers broader issues, the scope may need a written amendment. Starting early is particularly important when a suspected payment process remains active, because additional transactions can occur before records are secured.

Pricing varies more than many prospective clients expect. A narrowly scoped reconciliation and transaction review may cost approximately $10,000 to $40,000, while a multi-month forensic engagement involving payroll, procurement, data analytics, and legal-ready reporting can range from $50,000 to $250,000 or more. Highly complex matters involving multiple countries, extensive electronic discovery, expert testimony, or dozens of entities may cost several hundred thousand dollars. These are planning ranges rather than quoted fees. The engagement letter should state the fee basis, staff mix, expenses, assumptions about data access, and what happens if the scope expands.

The practical sequence begins with an allegation and evidence-preservation memo, followed by a written scope, engagement terms, and data request. The team then obtains and reconciles source records, performs risk-based analytics, tests selected transactions, interviews appropriate custodians, evaluates controls, and documents both exceptions and corroborating facts. Findings should be classified as confirmed, supported, unresolved, or outside scope, with monetary amounts tied to evidence. Recommendations should be ranked by likely impact and urgency, and the final report should be reviewed with the client for factual accuracy without allowing management to rewrite the auditor’s conclusions.

A short daily or weekly communication cadence can prevent surprises. At the beginning, the sponsor should confirm the objective and decision that the report must support. During fieldwork, the auditor can provide issue-status updates without prematurely labeling individuals or allegations as proven. Before issuance, management may correct factual errors, but the auditor remains responsible for the professional judgment and evidence. The client should retain the report, source-data inventories, analysis files, interview records, and calculation workpapers for the retention period required by law, contract, professional standards, or litigation needs. A 7-year retention period is sometimes used in financial records programs, but it is not universally appropriate for every forensic workpaper.

When to Act and What Results Mean

Prompt action is usually warranted when funds may still be moving, records could be altered, payroll continues, or a regulator has a short reporting deadline. Organizations should preserve legal holds, suspend unauthorized access where appropriate, and avoid tipping off a suspected participant when that action could jeopardize evidence. The board or audit committee should consider an independent forensic team if senior management is implicated, if internal audit reports may be compromised, or if the matter spans several entities. Acting promptly does not mean announcing guilt; it means controlling additional risk while allowing evidence and due process to develop.

A discrepancy can mean an accounting error, control weakness, unsupported business decision, breach of contract, theft, fraud, or an unresolved data-matching problem. The amount alone does not determine seriousness. A $5,000 duplicate payment may be financially small but reveal a recurring process failure, while a $1 million payment may be properly authorized and supported by extensive documentation. The report should explain the transaction, the person or process involved, the evidence reviewed, the potential impact, and the reason the conclusion was reached. Readers also need to know whether the issue is isolated or systemic.

The appropriate follow-up depends on the result. Confirmed unauthorized payments may require recovery, insurance notification, legal advice, disciplinary procedures, and revised access controls. Weak documentation may call for better contracts, approval matrices, reconciliation duties, and periodic monitoring. A systems issue may require access restrictions, audit-log retention, segregation of duties, and independent review of administrator activity. A successful forensic engagement therefore produces more than a list of exceptions: it identifies the conditions that allowed discrepancies to occur and provides a defensible route to reduce recurrence.

The strongest outcome is not a dramatic headline but a clear, proportionate response. The client should be able to state what was tested, what was found, what remains uncertain, how much loss is supported by evidence, and who will correct each deficiency by a defined date. If the investigation identifies broader exposure, the sponsor can expand the scope deliberately rather than allowing an uncontrolled escalation. If no material discrepancy is found, the report should still identify limitations and control observations, because a clean result within a limited scope is not a guarantee that every transaction was correct. That distinction is central to responsible financial audit work as of 1 October 2026.