How Do You Plan a Forensic Audit Engagement to Find Financial Discrepancies?

What a Forensic Audit Engagement Actually Is

A forensic audit engagement is an evidence-focused investigation designed to identify, explain, and sometimes quantify financial discrepancies that may result from error, misuse of assets, fraud, corruption, cyber-enabled activity, or unreliable accounting records. Unlike a financial statement audit, which primarily asks whether material statements are fairly presented in accordance with a reporting framework, a forensic audit begins with a specific concern and follows transactions, documents, systems, and people. It may examine accounts payable, receivables, payroll, procurement, inventory, cash, related-party dealings, or reported financial results. “Forensic accounting” and “forensic audit” are often used interchangeably in practice, although a court-facing investigation may require more defensible procedures than an internal review.

Also worth reading: How Should Organizations Review Financial Records for Discrepancies in 2026? · How Do Auditors Test Financial Close Controls Without Missing Hidden Discrepancies? · What Are the Best AP Control Testing Steps for Detecting Financial Discrepancies?

The engagement should have a precise written objective, defined scope, intended users, reporting standard, and authority to examine records. That definition matters because an organization saying only “audit everything” will receive a broader, slower, and more expensive review without knowing what decision the work must support. A useful objective might be to determine why vendor payments exceeded approved purchase records, reconstruct changes to an expense account over 24 months, or test whether payroll payments went to active employees. A conventional audit can find anomalies, but a forensic engagement links those anomalies to documentary evidence and plausible explanations.

How to Define the Allegation, Risk, and Scope

Management should first state the concern in neutral, testable language. “There may be an $800,000 discrepancy” is more useful than “finance is dishonest,” because it identifies a population, amount, period, and subject for examination. The initial allegation should then be separated into known facts, assumptions, rumors, and open questions. For example, a year-end cash variance of $620,000 is a fact, while an assumption that someone concealed the variance requires testing. This distinction reduces confirmation bias and helps investigators avoid turning unsupported suspicion into an asserted conclusion.

Scope should cover the relevant period, entities, locations, accounts, transactions, systems, vendors, employees, and control owners. Depending on the issue, the team may need general ledger data, bank statements, invoices, contracts, purchase orders, receiving records, payroll files, access logs, inventory records, email, device images, and interviews. A six-month review may be appropriate for a recent payment problem, while a multi-year review may be warranted when duplicate vendors, ghost employees, or management override are suspected. Sampling is useful for large populations, but targeted testing is usually necessary when the alleged scheme is specific.

The engagement letter should also address confidentiality, privilege, data retention, legal holds, access to third parties, and whether findings may be shared with regulators, insurers, auditors, or courts. An internal investigation is not automatically privileged merely because a lawyer requested one. Privilege depends on the purpose, participants, communications, and applicable law. Organizations should obtain advice before distributing broad allegations through routine email.

How the Investigation Is Performed

A competent forensic audit usually follows a sequence of planning, evidence preservation, risk mapping, data extraction, testing, analysis, interviews, reporting, and remediation. During preservation, the organization should secure relevant ledgers, email, accounting software, mobile devices, cloud records, and system logs. Changes to data can destroy context, so investigators should work from verified copies and document chain of custody where evidence could later be disputed. The team should not access or alter accounts outside its authorized scope without appropriate technical and legal controls.

Testing commonly includes duplicate payments, unsupported manual journal entries, unusual vendors, split purchases, round-dollar transactions, weekend payments, payroll duplicates, inventory shrinkage, sales cutoff errors, and related-party transactions. Analytics can identify outliers, but an anomaly is only a lead. For example, 17 payments totaling $483,000 made to one newly created vendor within 30 days might justify testing of bank details, approvals, invoices, and beneficial ownership. The investigator then determines whether the pattern has a legitimate explanation, indicates control failure, or supports a conclusion of misappropriation.

The reconciliation of source records is central. Payments should be matched to authorization, contract, invoice, receipt of goods or services, ledger entry, and bank settlement. Inventory should be connected to purchase records, movements, sales, physical counts, and write-offs. Interviews come after documentary work whenever possible because early questions can shape witnesses’ recollection or cause evidence to be coordinated. Conclusions should identify the evidence reviewed, procedures performed, limitations, and the distinction between facts, interpretations, and unresolved matters.

Budgeting, Team Selection, and Engagement Models

Forensic audit fees depend more on data condition, urgency, number of entities, and required defensibility than on a simple hourly standard. A narrow desktop review of one ledger issue might cost roughly $7,500 to $25,000. A multi-month investigation involving several entities, interviews, digital evidence, and extensive testing can range from $50,000 to $250,000 or more. Complex cross-border, multi-jurisdiction, or litigation matters can exceed that range. These are market-planning ranges, not fixed prices, and a responsible provider should quote after understanding records, systems, period, and objectives.

A small internal review may be reasonable for a limited, low-risk discrepancy with reliable digital records. An independent forensic team is more suitable when management integrity is questioned, significant money is involved, records are incomplete, or findings may be used in disciplinary, regulatory, insurance, or legal proceedings. A licensed fraud examiner or accountant can perform financial testing, while cybersecurity specialists, data analysts, employment lawyers, and digital-forensics providers may be needed for server images, device examination, or legal strategy. One firm should not be selected solely because it offers broad services.

These models can be combined. An organization may begin with a two-week analytical review, expand only the high-risk areas, and later commission broader assurance work. That staged approach controls cost but should be designed carefully because a narrow scope can miss related misconduct outside the initial sample.

Reporting Findings Without Overstating the Evidence

A forensic report should be understandable to decision-makers while preserving the detail needed by regulators, auditors, insurers, or courts. The report normally includes the mandate, scope, period, limitations, evidence examined, methods used, findings, monetary calculations, explanations obtained, control observations, and recommended actions. A conclusion should specify its level of certainty. “The population contains $428,600 in duplicate or unsupported payments” is different from “the suspected employee stole $428,600.” Only the first statement may be established by the available evidence.

Quantification also requires a defensible baseline. A discrepancy between two reports is not automatically a recoverable loss. The investigator should identify the authoritative record, adjust timing differences, exclude legitimate reclassifications, and consider whether taxes, inventory effects, or subsequent recovery change the amount. A schedule can show each affected transaction, date, amount, suspected error, supporting document, management response, and conclusion. Providing a clear bridge from general ledger balance to alleged difference helps prevent overstatement.

The report should distinguish control deficiencies from misconduct. Missing approval is an internal-control problem, but it does not by itself prove theft. Conversely, a carefully concealed override can support an intentional-act conclusion even when the person had authority. The tone should remain factual rather than sensational. Unsupported accusations can create legal, reputational, and employment harm, while vague observations leave management unable to correct the underlying process.

Common Mistakes That Weaken a Forensic Audit

The most damaging mistake is beginning without a written mandate. Ambiguous expectations produce duplicated work, missed issues, and disagreements about whether a particular population was covered. Another common error is assuming that a large variance is fraud rather than testing timing, classification, omitted records, and data conversion. Forensic work must also avoid relying exclusively on interviews or management representations when independent records are available.

Premature scope reduction is equally risky. Reviewing only the employees named in an allegation may leave the control design itself as the root cause. Conversely, reviewing every transaction can be wasteful when targeted sampling can reach a defensible conclusion. Investigators should document why a population, sample, or exclusion was selected. They should also preserve original data, maintain reproducible calculations, and record changes made during cleansing. If the source data was incomplete, no advanced software can remove that limitation.

Communication errors include circulating allegations too broadly, asking leading questions, allowing accused employees to alter records, or treating all anomalies as proof of a crime. A good investigator separates fact-finding from legal judgment and coordinates with counsel when criminal, regulatory, or employment consequences appear possible. A finding should never be drafted merely to satisfy the strongest narrative available before testing began.

When to Act Immediately and What to Do First

Immediate action is warranted when access to records is at risk, suspected funds are still moving, a bank account is being used for unauthorized transactions, evidence may be deleted, or a legal or reporting deadline is approaching. The first step is to stop avoidable loss without destroying evidence. Management can preserve bank access, suspend disputed payments under proper authority, secure backups, restrict unnecessary system changes, and document each protective action. It should not conceal evidence, access an employee’s accounts informally, or confront a suspected person before a plan is established.

A 72-hour response can include appointing an investigation lead, creating a restricted evidence repository, recording a legal hold, confirming relevant time periods, and listing the first 10 data sources. Within approximately two weeks, the team should normally complete a scoping review, identify missing records, perform preliminary analytics, and decide whether expansion is justified. The 72-hour and two-week milestones are practical planning targets rather than legal deadlines; urgency may require faster action.

Not every discrepancy requires a full forensic audit. A $1,200 cutoff difference with clear transaction support may be resolved through reconciliation. A $3.2 million unexplained cash movement, alleged ghost employees across 18 months, or possible alteration of management accounts warrants a formal investigation. Threshold-based escalation must consider both amount and severity: low-dollar duplicate payments can reveal broader control failures, while one isolated issue can be immaterial in a large organization.

Turning Findings into Remediation and Follow-Up

The audit is not complete merely when a discrepancy is reported. Management should correct balances, pursue recovery where appropriate, remove unauthorized access, strengthen approval controls, and monitor the affected process. Recovery decisions may involve insurance, restitution, litigation, tax reporting, or regulatory notification, so they should be handled by the responsible legal and finance teams. If a ledger error exists, the correction and supporting explanation should be recorded transparently rather than posted as an unexplained adjustment.

Remediation should address cause rather than only the found transaction. Duplicate payments may indicate weak duplicate-invoice detection, poor master-data controls, or inappropriate override access. Inventory shortages may require counting controls, segregation of duties, restricted stock movements, or independent reconciliation. If cyber-enabled activity is suspected, credentials should be preserved and reviewed, affected systems examined, and relevant legal notification duties assessed. Forensic accountants should not make unsupported guarantees that a control redesign will prevent all recurrence.

Follow-up commonly occurs after 30, 60, and 90 days, with additional testing at 180 or 365 days for persistent risks. The organization should track owner, due date, evidence of completion, residual risk, and closure approval. Because forensic procedures depend on evidence quality, a high-quality engagement is not one that finds the largest possible number of exceptions. It is one that reaches a reasoned, reproducible, and appropriately qualified conclusion and leaves the organization better prepared to detect similar discrepancies.