How Should an Accounting Discrepancy Investigation Be Conducted in 2026?

What an Accounting Discrepancy Investigation Actually Means

An accounting discrepancy investigation is a controlled process for determining whether reported figures, underlying records, or explanations differ materially from what the evidence supports. The difference may be an isolated clerical error, an accounting-policy judgment, a control failure, unauthorized activity, fraud, or a combination of these possibilities. A discrepancy does not by itself prove fraud, just as the existence of an audit does not guarantee that every error has been found. The objective is to identify the affected accounts, quantify the exposure, establish the cause, preserve evidence, and recommend corrections or recovery actions.

Also worth reading: How Does a Financial Discrepancy Investigation Work, and When Should Organizations Hire a Forensic Auditor? · What Is an Independent Accounting Investigation and When Do You Need One? · What is a financial discrepancy audit and how can it help uncover hidden accounting errors?

The starting point should be the population of financial records rather than one suspicious number. Relevant evidence can include general ledgers, bank statements, invoices, contracts, payroll records, tax filings, board minutes, reconciliations, system logs, and management explanations. Publicly reported cases illustrate how varied these matters can be: an initial $30 million disclosure error attributed by Rep. Ilhan Omar to an accountant, regulatory scrutiny of reconciliation issues involving IndusInd Bank, and investigations of public agencies after audits found accounting discrepancies. These examples are not interchangeable, but they demonstrate why source documents and a documented timeline matter.

A properly conducted investigation must also separate financial misstatement from disagreement about accounting policy. A company may legitimately choose a policy permitted by applicable standards yet still have documentation, disclosure, or control problems. Conversely, a small difference can be operationally important if it involves related-party payments, cash, revenue recognition, or management compensation. The initial conclusion should therefore remain provisional until the amount, cause, intent, and broader control environment have been tested.

When to Open a Formal Investigation

Management should open a formal investigation when a reconciliation remains unresolved after normal review, a transaction lacks credible documentation, a system-generated report conflicts with the general ledger, or an employee reports possible manipulation. A board or audit committee should become directly involved when the issue could affect audited financial statements, involves senior management, threatens solvency or liquidity, has repeated across reporting periods, or may create legal and regulatory exposure. A suspected conflict of interest is also a reason to move the matter outside ordinary management channels.

As a practical trigger, an unexplained variance of 5% or more in a material account deserves documented review; materiality still depends on the account and the entity. Smaller amounts should not be ignored when they are repetitive, conceal a larger pattern, involve cash or estimates, or affect a covenant. Organizations should not wait until a discrepancy reaches 10% of assets, profit, revenue, or a reporting threshold before checking the facts. Legal materiality standards are entity-specific, while regulatory and contractual tests may use separate quantitative or qualitative rules.

Timing is especially important after an audit adjustment, whistleblower report, bank exception, or regulator inquiry. A useful rule is to acknowledge the allegation within one business day, preserve evidence immediately, appoint an independent owner within several days, and establish a preliminary 30-day reporting plan. Those are management-planning targets, not statutory deadlines. If suspected criminal activity, evidence destruction, ongoing customer harm, or material misstatement is identified, qualified counsel may need to preserve privilege and coordinate with law enforcement or a regulator.

The decision to investigate internally, through an independent forensic accountant, or through a full-service audit firm should reflect risk rather than prestige. The wrong choice can cost more, produce duplicate procedures, and disrupt operations. Independence is the central issue: anyone who designed the process, approved the transactions, maintained the records, or has a personal stake should not control the evidence review.

The Investigation Process From Scope to Reporting

The first phase defines the question, period, entities, accounts, and systems involved. Investigators should create an allegation register, identify the last reliable closing date, list known records, and establish what is known, unknown, alleged, and verified. They should then trace transactions in both directions: from the reported balance to supporting evidence and from the source evidence back to the reported balance. Sampling alone may miss management override, so targeted testing should address journals, manual entries, unusual vendors, related parties, and changes in estimates.

The second phase tests the reconciliation process. Bank reconciliations should agree to bank statements and the general ledger, with old outstanding items, timing differences, transfers in transit, and chargebacks separately explained. Account reconciliations should identify the preparer, reviewer, date, supporting evidence, and resolution of differences. The investigator should recalculate high-risk balances, inspect subsequent clearing, confirm counterparties where appropriate, and compare results with prior periods, budgets, tax returns, and audited statements.

The third phase evaluates cause and control effectiveness. An error might result from a mistyped number, an incorrect cut-off, a missed interface, a misunderstanding of a contract, or deliberate concealment. Those causes require different corrections. Management should identify the transaction owner, review the original policy in force at the time, quantify affected periods, and test whether comparable errors occurred elsewhere. Root-cause analysis is useful only when supported by evidence; accepting the first convenient explanation weakens the investigation.

The final report should distinguish findings, conclusions, limitations, and recommendations. Each quantified finding should state the account, period, amount, evidence, cause, financial effect, and proposed correction. A report that merely says books were unreliable is not actionable. It should also explain whether restatement is needed, whether tax or regulatory reporting is affected, which controls failed, whether misconduct occurred, and what management should do to prevent recurrence.

Evidence, Controls, and Professional Standards

Audit evidence is information obtained by auditors and retained in working papers to support financial reporting and audit conclusions. During an investigation, external evidence such as bank-confirmed data, signed contracts, third-party confirmations, and regulator records is generally more persuasive than an unsupported management statement. Computer-generated data also requires reliability testing, including checks over access rights, timestamps, audit logs, and whether the system extracts the complete population. Digital records should be preserved in native format with appropriate hashes or forensic copies where litigation is reasonably possible.

Investigators should follow a documented chain of custody and avoid altering source files. Access to records should be limited by role, and copying a shared spreadsheet can change metadata or expose confidential data. Interviews should be planned, factual, and recorded according to applicable law and policy. Investigators should avoid asking a witness to reconstruct evidence from memory, and they should not imply that fraud has already occurred merely to obtain a more responsive answer.

Professional standards provide structure but do not replace legal advice. AICPA attestation standards govern many financial examinations, while AICPA Statement on Standards for Forensic Services No. 1 addresses the general and specific skills needed in forensic accounting and fraud examination work. COSO’s 2013 Internal Control—Integrated Framework identifies five components and 17 principles across control environment, risk assessment, control activities, information and communication, and monitoring activities. An investigation can use those principles to test whether a reconciliation failure was isolated or reflects a wider control problem.

For financial statements, the applicable accounting framework and audit findings must be evaluated by qualified professionals. “GAAP” is not universally applicable: a private company, government body, bank, or nonprofit may operate under another framework. As of 29 September 2026, no investigation can safely be resolved by applying a generic percentage threshold or assuming an external audit covered the same period. Scope, independence, professional judgment, and applicable law govern the work.

Internal Review, Forensic Audit, or Full Audit?

An internal review is appropriate when the issue appears localized, management is not implicated, systems remain intact, and the potential misstatement is unlikely to affect audited statements. A forensic accounting investigation is suited to suspected fraud, asset misappropriation, concealment, complex related-party matters, or litigation support. A financial statement audit provides an opinion on a financial reporting framework but is not primarily a fraud investigation. A combined “forensic audit” should have separately defined objectives and deliverables so that the audit opinion is not confused with a fraud conclusion.

Organizations comparing providers should examine relevant credentials, sector experience, independence, methodology, communication plan, and fixed deliverables. A low fee may be reasonable for a narrow reconciliation, but too little funding can result in limited interviews, no system testing, and unsupported conclusions. A high fee likewise does not establish quality. Requests for references and a sample work plan are more useful than promises of guaranteed detection, because no provider can reasonably guarantee that every discrepancy or fraud will be found.

Costs, Staffing, and Expected Timeframes

A simple internal reconciliation review may cost little beyond staff time and range from roughly $2,500 to $15,000 if outsourced for a limited matter. A multi-account forensic investigation commonly costs from $25,000 to $150,000, with complex engagements spanning systems, several years, multiple entities, or litigation potentially exceeding $150,000. These are planning ranges rather than market quotations. Total cost depends on record volume, data quality, interviews, location, specialist requirements, regulatory demands, and whether counsel, cybersecurity experts, valuation specialists, or tracing specialists are needed.

A focused bank or ledger reconciliation can sometimes be completed in 5 to 15 business days. A 30- to 90-day investigation is common when several years, multiple systems, and numerous witnesses are involved. A securities-related matter may require counsel and auditors to work under deadlines imposed by filings, exchanges, or regulators. The organization should request a written budget with hourly rates, expenses, staffing assumptions, interim milestones, change-control procedures, and a cap or explanation for overruns.

Cost containment should never come at the expense of evidence preservation or independence. Performing the work with fewer people merely to meet a target may create a single point of failure and weaken credibility. Organizations can control expenses by limiting the initial scope, securing clean exports, identifying system owners, preserving relevant records, and resolving privilege questions early. They should also avoid “paying for an audit” when they actually need a reconciliation, and they should not commission a broad forensic review before confirming that the issue is material enough to justify it.

The expected financial outcome may include corrected entries, recovered funds, insurance proceeds, covenant changes, tax adjustments, restatements, penalties, or litigation. Investigators should quantify reasonable scenarios but avoid presenting an uncertain recovery as guaranteed. An alleged $2 million overstatement may not result in a $2 million loss if it is offset elsewhere, reversed before reporting, reimbursable, or already reflected in a correct liability. Conversely, a $100,000 entry may cause disproportionate regulatory or contractual consequences because it is concealed or relates to executive compensation.

Common Mistakes That Weaken an Investigation

A frequent mistake is beginning with an accusation instead of a testable allegation. This produces defensive interviews, inconsistent evidence, and premature public claims. Another error is relying on one supposedly “impartial” employee whose authority is unclear. The reviewer must be independent enough to challenge both management and the underlying data. Organizations also fail when they ask investigators to determine every possible issue at once without defining the relevant period, accounts, and transactions.

Documentation is routinely mishandled. Deleting emails, overwriting spreadsheets, changing journal narratives, or reconstructing old records can destroy evidence and create legal problems. Investigators should preserve originals, document each request, record who had access, and maintain reproducible working papers. Small adjustments should not be buried inside a large aggregate entry because aggregation can hide both the amount and the responsible party.

Another common mistake is treating an audit, reconciliation, or analytical review as proof of either honesty or fraud. A clean audit provides reasonable—not absolute—assurance and is based on the audit’s scope and risk assessment. A reconciliation proves only that specified balances agree under specified procedures; it does not establish that a transaction was commercially justified or accurately recorded initially. A strong investigation integrates these procedures and states limitations openly.

Finally, reports often fail because recommendations are vague. “Improve controls” is not enough. The organization should specify the control owner, evidence of operation, review frequency, completion date, and testing method. For example, requiring monthly bank reconciliations is not a remedy if the same reviewer approves both the payment and the reconciliation without independent evidence. Corrective action should address why the discrepancy occurred and why existing detection did not stop or reveal it sooner.

When to Escalate, Restate, or Notify Regulators

Escalation should occur as soon as credible evidence suggests material misstatement, senior-management involvement, unauthorized access, destruction of records, insolvency risk, or continuing harm. The audit committee should receive the facts without unnecessary delay, while counsel assesses privilege, reporting obligations, insurance coverage, and legal exposure. Suspected securities or banking fraud may require prompt contact with qualified regulatory counsel, because public statements, amended filings, exchange notices, bank notifications, and tax corrections can have different deadlines.

Restatement or correction is not automatic. Professionals must evaluate the applicable reporting framework, materiality, period covered, effect on prior statements, and whether the original filing was public. An entity should not wait for a final fraud adjudication before correcting a demonstrable arithmetic error, nor should it label every policy difference a fraud. A known error can be corrected through the proper reporting channel even where intent remains unresolved, while a legal investigation can continue in parallel.

A practical escalation matrix assigns severity using both financial and nonfinancial factors. For example, an unresolved variance of $1 million may warrant immediate escalation if it is 15% of reported net income, affects a debt covenant, or involves the chief financial officer. A $5,000 variance may warrant similar treatment if it suggests repeated journal overrides, bypassed segregation of duties, or missing tax records. The purpose of the matrix is to speed decisions, not to replace legal or professional judgment.

Organizations should also set closure criteria. A matter is not closed merely because management posts a journal. Closure normally requires validated corrections, documentation, control remediation, recovery or impairment decisions, and an agreed monitoring period. For higher-risk findings, a 90-day post-implementation test can confirm that the revised control operates consistently. If new evidence appears, the matter should be reopened under the same governance process rather than handled informally.

What a Reliable Final Report Should Deliver

A reliable final report gives decision-makers a clear, evidence-based account of the discrepancy. It should quantify the error by account and period, explain the transaction path, identify missing or unreliable evidence, evaluate alternative explanations, and state whether the evidence supports error, control weakness, misconduct, or an unresolved issue. It should also distinguish the financial effect from the amount involved, because an overstated revenue transaction and an overstated expense can have different reporting consequences even if both are later reversed.

The report should describe the population and procedures performed so another reviewer can understand how conclusions were reached. A 100% test of 842 journal entries supports a different statement than a five-item sample. If records were unavailable, the limitation should be specific, and management should not expect a definitive conclusion where evidence cannot support one. Interview summaries should be attributed accurately and treated as evidence to evaluate, not automatically as proof.

Recommendations should be prioritized by risk and assigned to named owners. The organization might need to reverse entries, amend returns, recover transfers, tighten journal approval, segregate duties, validate master data, monitor unusual vendors, or require independent confirmation of related parties. It should also consider whether other periods, subsidiaries, or accounts require review. The final deliverable should be written for the board, audit committee, legal team, regulators, insurers, and courts at different levels of technical detail, with one consistent set of verified numbers.

The best answer is therefore not whether every difference is immediately labeled fraud. It is whether the organization launches a proportionate, independent, and documented process, tests the full transaction trail, corrects verified errors, remediates control failures, and escalates when facts demand it. As of 29 September 2026, that remains the defensible standard for an accounting discrepancy investigation, regardless of the amount, sector, or presence of an existing audit.