What Is the Forensic Audit Process for Finding Financial Discrepancies?

What Is a Forensic Audit?

A forensic audit is a detailed examination of financial records, transactions, controls, and related evidence to identify suspected errors, fraud, misuse of funds, or unauthorized activity. Unlike a standard financial audit, which primarily evaluates whether financial statements comply with an applicable reporting framework, a forensic audit focuses on explaining what happened, where problems occurred, who may be responsible, and how much money may be affected. The process is commonly used after an unexplained cash shortfall, accounting manipulation allegation, invoice anomaly, bankruptcy, divorce dispute, regulatory investigation, or discovery of weak internal controls. The term “forensic” does not automatically mean that fraud has been proven. It describes a more intensive and evidence-oriented method of tracing financial activity. Public bodies frequently commission such reviews when elected officials cannot account for spending, while private organizations may use them for shareholder disputes, litigation, employee misconduct, or cyber-enabled financial crime. The correct scope should be written before any records are examined, and the final report should distinguish confirmed discrepancies from anomalies that merely require additional investigation.

Also worth reading: How Is AI Used to Control Financial Audits and Find Discrepancies? · How Should Organizations Investigate and Resolve Financial Discrepancies in 2026? · How Do Auditors Test Financial Close Controls Without Missing Hidden Discrepancies?

How the Forensic Audit Process Works

The process usually begins with an engagement letter that defines the period, accounts, locations, transactions, systems, allegations, and reporting requirements. Investigators then preserve source records, obtain read-only copies where possible, and create a reliable audit trail. Data is reconciled across bank statements, ledgers, invoices, contracts, payroll records, tax filings, procurement files, and supporting documentation. Analysts use sampling, exception testing, analytical procedures, duplicate-payment searches, vendor master comparisons, and tracing of funds to identify possible problems. Findings are tested with the people or departments involved so that legitimate explanations can be considered. A defensible engagement normally uses a chain of custody, reproducible calculations, documented interviews, and clear limitations on what the evidence can prove. Automation can accelerate transaction matching, but a software-generated exception still needs human review because formatting differences, valid adjustments, and incomplete records can create false positives.

Evidence Collection and Preservation

Evidence preservation is one of the most important parts of the process because financial data changes through normal business activity. Before the review, the auditor should identify custodians of relevant records and preserve complete datasets rather than relying only on reports extracted by management. In a digital environment, relevant evidence may include email attachments, accounting-system audit logs, approval histories, user access records, cloud files, procurement-platform data, and device images if cyber activity is suspected. Each item should receive a unique identifier, with its source, date obtained, and responsible custodian recorded. Hash values can verify that a copied file has not changed, while signed or otherwise documented transfer procedures support later authentication. The team should also issue a litigation hold or records-preservation instruction when litigation, regulatory action, or possible criminal conduct is foreseeable. Deleting apparently duplicate records before scoping the investigation can destroy context, so investigators should preserve them and determine later whether they are genuine duplicates.

Analytical and Transaction-Level Testing

The analysis phase converts large volumes of accounting data into testable exceptions. Common procedures include reconciling bank accounts, tracing cash and journal entries to supporting records, comparing invoices to purchase orders, checking vendor details against payment data, and examining whether sales were recorded appropriately. In payroll testing, investigators may review duplicate bank accounts, unusual hours, terminated employees receiving payments, or employees lacking the proper authorization. Public-fund reviews often test restricted revenues, intergovernmental receipts, capital spending, and payments exceeding established approval thresholds. Exact thresholds should be based on the organization’s documented controls rather than an arbitrary rule; for example, any payment above $10,000 may warrant review only if $10,000 is the applicable approval limit or indicates an established risk pattern. A 5% discrepancy rate is not automatically material if the records contain minor timing differences, but it becomes concerning when the same issue recurs across several months or amounts. Analysts should quantify both the gross exception rate and the adjusted error rate after legitimate explanations are considered.

Interviews, Corroboration, and Validation

Documents rarely establish intent by themselves, so investigators usually interview relevant custodians and decision-makers after completing preliminary testing. An interview should seek an explanation, identify the records supporting that explanation, and reveal who performed or approved the transaction. Investigators should avoid asking a witness to retrieve or alter records independently, and written follow-up may be appropriate when the explanation affects material findings. Corroboration can include board minutes, contracts, receipts, bank confirmations, payroll registers, shipping records, email, and accounting-system logs. A management explanation should not automatically clear an exception, particularly if the same manager controls initiation, approval, recordkeeping, and reconciliation. Conversely, an unusual transaction is not proof of theft. For instance, three payments to the same vendor within 48 hours might reflect a legitimate emergency project, but it warrants review of the purchase authorization and duplicate-invoice controls. The best findings connect the accounting exception to independent evidence and state clearly what has and has not been demonstrated.

What Forensic Audits Cost and How They Differ

There is no responsible single market price for a forensic audit because scope, data volume, systems, locations, and expected work product can differ by more than an order of magnitude. A narrowly scoped desktop review of one business unit might cost several thousand dollars, while a multi-year public-sector investigation involving many entities and litigation-ready digital evidence can reach hundreds of thousands or more. As of 2026, organizations should obtain at least three written proposals and compare professional fees, travel, data extraction, expert testimony, taxes, and assumptions about personnel interviews. Fixed fees are feasible when the records and questions are stable, but time-and-materials billing may be safer when the number and quality of exceptions remain uncertain. Cost is not determined only by hours; preserving systems and interviewing witnesses can consume much of the budget. The table below distinguishes a forensic audit from related services without implying that any cheaper option can answer every allegation.

A common mistake is beginning with a predetermined conclusion that all discrepancies are fraud. That approach can bias sampling, color interview questions, and undermine credibility in court or a regulatory forum. Another error is letting the suspected control owner select records or perform the reconciliation without independent verification. Management-prepared spreadsheets can be useful if their source data and calculations are tested, but they should not be treated as self-proving. Small unexplained balances are often ignored even when they connect to a broader pattern; repeated $500 expenses can matter more than one isolated clerical error if they bypass the same approval process. Poor engagement scoping is equally damaging, especially when the request uses vague language such as “check everything.” Counsel should define the period, entities, accounts, allegations, custodians, reporting audience, privilege expectations, and permissible methods in advance.

Additional mistakes include failing to distinguish error from fraud, issuing broad conclusions from limited evidence, or quantifying losses without considering offsets and later corrections. Investigators should not characterize a deficiency as “embezzlement” unless reliable evidence supports that legal conclusion; “unsupported payment,” “possible unauthorized transfer,” or “control failure” may be more accurate. The reporting team should also avoid assuming that a person who approved a transaction knew it was improper. A useful report separates the amount, frequency, control weakness, plausible explanation, corroborating evidence, and unresolved uncertainty for every material exception. Finally, the audit should preserve reproducibility. A reviewer should be able to trace each number from the report back to the underlying ledger, bank record, contract, or source file.

When to Act and What Not to Expect

Immediate action is appropriate when active losses may continue, evidence is at risk of deletion, bank access is insecure, or a legal preservation duty may exist. Management can temporarily strengthen dual approval, restrict access to master vendor and payroll changes, confirm the last complete backup, and independently review recent payments while qualified investigators establish the formal scope. The organization should avoid confronting or accusing suspected individuals before preserving evidence and considering legal privilege, labor obligations, and the risk of tipping off someone who can destroy records. Acting quickly does not mean publishing a preliminary allegation as a final finding. It means stabilizing the situation, preserving information, limiting further exposure, and commissioning work that can withstand later challenge. Delay may be reasonable when the issue is old, no live system is at risk, and the objective is limited education rather than legal attribution, but even then records should be retained according to the applicable legal and contractual requirements.

The result of a forensic audit is not automatically criminal prosecution, repayment, or an audit opinion. It may confirm that a $52,000 invoice total included $12,000 of unsubstantiated expenses, identify repeated duplicate payments, or show that a $700,000 spending question arose from missing records and poor reconciliations. By contrast, an investigation may find no financial discrepancy after documenting legitimate explanations and control improvements. That is still a valid result. A credible reviewer should state the procedures performed, populations examined, limitations, unresolved items, and whether the conclusions can be extrapolated beyond the tested records. Anyone seeking a legal determination should discuss the report with qualified counsel because accounting evidence, employment issues, criminal liability, and regulatory consequences involve different standards of proof.

A Defensible Reporting Approach

A strong report begins with an executive explanation of scope, period, data sources, and overall conclusions, followed by detailed findings ordered by financial or risk priority. Each finding should describe the condition, relevant criteria, cause, effect or potential exposure, evidence, response received, and recommended corrective action. Monetary amounts should be reconciled to the accounting records and clearly labeled as confirmed, estimated, unsupported, or subject to further investigation. The report should avoid overstating precision when only a range can be supported, but it should not hide a documented point estimate behind vague language. Recommendations should address both immediate corrections and system-level causes, such as incompatible payment approval, weak vendor onboarding, or the absence of independent bank reconciliations. A separate response from management can document disagreements or promised remediation, which is often more useful than pretending the engagement’s work is finished when a report is delivered. Effective remediation should be retested after implementation rather than accepted solely because management says a policy was changed.