What Is the Forensic Audit Process for Finding Financial Discrepancies?

Direct Answer: What Is a Forensic Audit?

A forensic audit is a focused financial investigation designed to identify, explain, and sometimes quantify errors, control failures, misuse of funds, fraud, or other discrepancies. Unlike a financial statement audit, which primarily tests whether accounting statements are fairly presented under recognized accounting standards, a forensic audit follows a specific concern, allegation, transaction pattern, or unexplained difference. The investigator collects and preserves evidence, reconstructs transactions, tests internal controls, interviews relevant people, and documents both exceptions and plausible explanations. The result is usually a factual report rather than an assurance opinion, although legal counsel, regulators, insurers, lenders, and courts may use its findings in later proceedings.

Also worth reading: How Should Organizations Review Financial Records for Discrepancies in 2026? · How Is AI Used to Control Financial Audits and Find Discrepancies? · How Do Auditors Test Financial Close Controls Without Missing Hidden Discrepancies?

The phrase “forensic audit process” is sometimes used loosely for electronic-data recovery, cybersecurity examinations, or election audits, but those activities are not necessarily accounting investigations. In a financial matter, the process connects accounting evidence with digital evidence when records exist in spreadsheets, accounting systems, email, banking platforms, or cloud applications. The scope should be defined before work starts because examining five years of transactions across multiple entities can cost far more than tracing one $322,000 discrepancy. As of September 29, 2026, the best definition is therefore not “an audit that catches everything,” but a disciplined inquiry that tests a defined population and produces reproducible findings.

Why Organizations Use a Forensic Audit

Forensic audits are commonly commissioned after cash shortages, duplicate payments, unsupported journal entries, payroll anomalies, related-party payments, missing assets, procurement concerns, or conflicts between reports and source records. Public bodies may commission one after alleged misuse of taxpayer funds, while companies may use one during divorce proceedings, shareholder disputes, litigation, insurance claims, or internal investigations. The objective can range from reconciling one bank account to testing an entire procurement system. Evidence should be placed in context: a round-number payment may be ordinary, for example, while thousands of payments split just below an approval threshold may indicate control circumvention.

The process is valuable because ordinary audits use risk-based sampling and are not designed to prove that every transaction was correct. A statutory audit may establish that statements are materially free of misstatement, but that does not mean no individual payment was unauthorized or that every control operated effectively. A forensic audit instead emphasizes the completeness and accuracy of a targeted data population, the identity of approving parties, the movement of funds, and the chronology of decisions. It is still subject to sampling, access limitations, missing records, management explanations, and the quality of available digital evidence.

## Evidence Preservation and Initial Scoping

The first stage is preserving evidence, not immediately drawing conclusions. Investigators should identify relevant accounting systems, bank records, invoices, contracts, payroll files, minutes, emails, chat messages, access logs, devices, cloud accounts, and third-party confirmations. A documented chain of custody helps show that files were not altered after the allegation arose. Working copies should be created, write protection or equivalent safeguards should be used, and original files should be retained with hashes where appropriate. If litigation is reasonably anticipated, counsel may direct the preservation process because routine document collection can conflict with legal duties or privilege.

The engagement letter should define the allegation, relevant periods, entities, accounts, systems, custodians, budget, target completion date, and expected deliverables. A useful scoping threshold is materiality expressed in dollars, such as every discrepancy above $5,000, all related-party payments regardless of amount, and all manual entries above $25,000. Those figures are examples rather than universal rules; a $1,000 monthly theft across five years may become more serious than a single $20,000 error because it may reveal an ongoing control problem. Investigators should also document what cannot be tested, such as deleted email, inaccessible bank portals, or records that no longer exist.

Records should be collected in native format when possible. A PDF invoice may be useful, but a spreadsheet containing formulas, metadata, revision history, or hidden worksheets may provide stronger evidence. Investigators should test whether dates, vendors, account codes, approval fields, and payment references agree across the source system and supporting documents. Time zones, system-generated timestamps, currencies, and accounting cutoffs must be normalized without overwriting originals. This early discipline reduces the risk that an apparently small mismatch is later dismissed as a data-conversion problem.

Transaction Tracing, Testing, and Reconciliation

The core work normally begins by establishing a reliable baseline population. For cash, the team may reconcile bank statements to the general ledger, cash registers, deposit slips, and approved reconciliations. For accounts payable, it may extract all payments in a defined period, remove duplicates, compare vendor master files, and test invoices against contracts, receiving records, approval thresholds, and bank beneficiaries. For payroll, it may compare employee rosters to tax filings, time records, bank destinations, and termination dates. Each exception should be labeled as an error, control weakness, unsupported transaction, possible fraud indicator, or unresolved item rather than automatically called fraud.

Good forensic testing is reproducible. An investigator should be able to show the source population, filtering criteria, formulas or database queries, amounts examined, exceptions identified, and management response. Duplicate testing, for instance, may use exact and near-duplicate matching based on vendor, date, amount, invoice number, and bank reference. Benign recurring charges can be excluded only after their business purpose is established. Related-party testing should trace ownership and control relationships, while journal-entry testing should examine unusual users, weekend or year-end activity, unsupported narratives, manual postings, and entries that offset expected supervisory review.

Digital evidence can support the accounting analysis, but its limits must be stated. Metadata may establish when a file was created or modified, while email may identify an approval or instruction; neither alone proves the underlying financial event. Conversely, a missing email does not disprove a transaction because messages may be deleted, archived, or never created. The New Hampshire Department of Justice has published forensic audit material, including a report associated with New Hampshire Senate Bill 43, illustrating that public forensic work must connect quantitative analysis to the statutory questions assigned. The accounting conclusion should rest on converging evidence, not one dramatic file.

Interviews, Explanations, and Corroboration

Interviews often determine whether a discrepancy is a bookkeeping mistake, an approved business decision, a control failure, or evidence of misconduct. Investigators should prepare a chronology, request records in advance, ask neutral open-ended questions, and distinguish facts from conclusions. It is better to ask, “What did you observe when this payment was approved?” than, “Why did you steal company funds?” Multiple sources should be compared, such as board minutes, email approvals, vendor contracts, delivery evidence, and bank instructions. Statements should be documented with dates, participants, and follow-up commitments, and material changes should be confirmed through independent records.

Management explanations can close a legitimate exception but rarely should end the inquiry by themselves. A supplier may provide a corrected invoice after confirming that the original omitted a line item, or an employee may explain a payroll change supported by a dated human-resources form. The investigator should seek documentary corroboration and test whether the explanation is consistent across periods. If a witness says a payment was approved verbally, the team may examine meeting calendars, message records, signatures, and subsequent board ratification. If no evidence supports the explanation, the finding should remain unresolved, with the missing evidence stated explicitly.

Involving legal counsel can be appropriate at several stages, especially when privilege, employee rights, data privacy, or anticipated litigation is involved. Counsel can help define the mandate, preserve documents, coordinate interviews, and decide whether specialist testimony is warranted. Counsel should not decide accounting results, however, and an internal report should clearly identify which facts are verified, which are inferred, and which remain disputed. Findings should avoid sensational language when evidence supports only a control problem, while still describing serious conduct directly if the evidence warrants it.

Reporting Findings and Control Remediation

A forensic report normally includes the scope, objectives, criteria, methods, evidence examined, limitations, findings, monetary totals, explanations received, and recommendations. Each material finding should connect a condition to evidence and a consequence. “Three invoices lacked receiving documentation, representing $84,600” is more useful than “weak procurement controls,” particularly if the invoices also bypassed the normal approval threshold. Monetary schedules should reconcile to the population tested, and totals should distinguish confirmed loss, questionable cost, unsupported expenditure, duplicate payment, and unresolved difference.

Reports should be written for several audiences. A governing body may need an executive explanation, while auditors, regulators, or courts may need schedules and technical detail. A public release may require redactions or careful treatment of personal information, and allegations against identifiable people should not be repeated as established facts. The report should preserve source identifiers and cross-references, but sensitive data can be placed in a separately restricted appendix where necessary. Final conclusions should be dated so later readers know which records and answers were available at the time.

Remediation may involve separating invoice creation from payment approval, requiring dual authorization above a defined threshold, changing vendor master data through independent verification, locking dormant payroll accounts, rotating system access, and introducing monthly bank-to-ledger reconciliations. A useful threshold could require secondary approval for payments above $10,000, but the correct amount depends on the organization’s size and risk. Controls are strongest when they operate automatically, produce exception reports, and are reviewed by someone independent of the transaction initiator. Technology can reduce opportunities for error, but no accounting software can make a fabricated approval legitimate.

Cost, Timing, and Choosing the Right Approach

Forensic audit pricing depends heavily on scope, data quality, number of entities, urgency, and whether testimony is required. Small engagements such as tracing one bank account or reviewing a few hundred transactions may cost roughly $5,000 to $25,000. A broader investigation involving multiple years, several subsidiaries, payroll, procurement, electronic evidence, and interviews can range from $50,000 to more than $250,000. U.S. forensic and financial experts may bill approximately $150 to $500 per hour, while larger firms can charge more; legal discovery, forensic data recovery, expert reports, and expert-witness work may be separate from accounting fees.

Timing is similarly variable. A limited reconciliation might take one to three weeks, while a multi-system investigation may require three to nine months. The contextual claims that automation can reduce a 4-week case to approximately 3 minutes describe software extraction and comparison, not a complete legal or accounting investigation. Interviews, judgment, document requests, source validation, and reporting still require people. The 2026 guide for this topic should treat automated tools as aids that improve consistency and processing time, not as substitutes for professional judgment or a guaranteed determination of fraud.

## Common Mistakes and When to Act

A frequent mistake is beginning with a conclusion instead of an objective. Another is asking investigators to review “everything” without defining the period, population, or decision that the report must support. Inadequate preservation can destroy evidence; uncontrolled access to employees or management can create claims of interference; and converting spreadsheets without checking units, dates, or account mappings can produce false discrepancies. Other errors include treating a name match as proof of a fictitious vendor, counting the same unpaid invoice and bank payment as two separate losses, and omitting credits, refunds, or later reversals from a loss calculation.

Prompt action is usually justified when evidence may be deleted, funds are still moving, users still have privileged access, or legal deadlines are approaching. Organizations should preserve records, suspend only genuinely necessary access, secure relevant devices and accounts, and notify insurers, boards, regulators, or counsel when obligations may apply. They should avoid public accusations and broad document destruction before facts are established. A short internal triage within 48 to 72 hours can identify the affected accounts, custodians, and immediate preservation needs, but the decision to launch a full investigation should be based on exposure, credibility, and potential recovery rather than panic.

The most defensible forensic audit is independent, narrow enough to control, broad enough to answer the central question, and transparent about limitations. It does not promise certainty where evidence is absent, and it does not convert every anomaly into criminal conduct. Its value lies in producing a defensible account of what happened, how much is unsupported, why it occurred, and what controls can prevent recurrence. That makes it different from both a mechanical reconciliation and a conventional financial statement audit.