Forensic analysis for litigators. audit committees. trustees. receivers. general counsel. fidelity insurers. boards. defense counsel.

The conclusion every client wants — that this was fraud — is the one an AICPA member or a certified fraud examiner is barred from stating; the standards reserve it for the trier of fact. What they permit is almost everything short of the verdict, including that funds were misappropriated and that each element is satisfied. The finding survives. Only the label is withheld.

3areas
9subject areas
43%of occupational frauds first surface by tip
How it works

The traceable claim decays, and it does not recover on its own.

Where misappropriated money is commingled with clean money, courts commonly apply the lowest intermediate balance rule: the traceable interest is capped at the lowest balance the account reached after the tainted deposit, and later deposits do not restore it. As the Fourth Circuit put it in In re Dameron, in no case is the trust permitted to be replenished by deposits made subsequent to the lowest intermediate balance, and if the account is depleted entirely the trust is considered lost. A single touch of zero can end a proprietary claim permanently, however many millions move through the account afterward. That is why the sequence is fixed: trace first, freeze second, and both before the account runs down.

Traditional
Pulling the statements a year later
With the Institute
A claim that still traces

Fix the Retention First

Who signs the engagement letter decides what is privileged, and there is no federal accountant-client privilege to fall back on. A Kovel retention does not reach back over work already done in-house. Retention, scope and privilege.

Find the Trail It Leaves

Skimming takes the cash before it is recorded, so no entry exists to find and the books still balance. In a corruption matter the money often never touches the victim’s accounts at all. Anatomy of fraud schemes.

Trace Before You Freeze

Under Grupo Mexicano a federal court generally cannot enjoin a defendant from moving assets to secure a claim for money damages. It is the claim to specific traceable property that supplies the authority. Tracing and asset recovery.

begin here

What did you find, and how did you find it?

Describe the matter to the Forensic Concierge. It will help you see which records the question turns on, what a competent investigation would examine, and what expertise the matter needs. It does not investigate live matters, does not tell you whether a particular person took anything, does not say whether fraud occurred or whether an auditor fell short, does not value a claim, and is not legal advice.

Forensic Conciergeorientation, not a finding of fraud
Tell me roughly what surfaced, how it came to light, and what has happened since. If money may still be moving, the first useful question is whether the account statements and deposit items have been secured — the traceable claim is set by the account’s balance history, and that history only gets worse.
Advisory

When the investigation itself becomes the exhibit

The decisions taken in the first fortnight — who signs the engagement letter, whether predication was established and recorded, what was preserved, whether the accountant sits under counsel, whether exculpatory evidence was weighed alongside the rest — are what opposing counsel attacks two years later, long after the findings have stopped being controversial. The Institute reviews the scope and the method independently, for a fixed fee agreed in advance, either before the work starts or on an investigation somebody else has already run.

writing from the Institute

The uncomfortable parts, said plainly.

That the books balance is not a defense — a scheme that takes the cash before it is recorded leaves no entry to find. The strongest evidence in a bid-rigging matter is usually not an accounting record at all. And the amount still recoverable is capped by a number that only ever falls.

All insights
A row of bound audit working-paper binders on a boardroom credenza, one lying open with pencil tick marks running down a column of figures
Detection & Investigation
Why didn't our auditors catch the fraud?
Because the standard the audit was performed under asks a narrower question than the one you are asking, and it is bounded by materiality. That is not a defense of auditors: the same paragraphs that explain non-detection are the ones an audit-failure claim gets built from.
September 9, 2026
Two unopened engagement letters lying side by side on a long boardroom table, a single pen between them
Detection & Investigation
Should our company hire the forensic accountant, or should our lawyers?
Counsel, in almost anything that could become a case. There is no confidential accountant-client privilege under federal law, and the arrangement that supplies a privilege argument operates forward rather than backward.
September 9, 2026
Two framed professional certificates hanging on a panelled office wall, one a little lower than the other, lit from a window off to the side
Detection & Investigation
What's the difference between a CFE and a CFF?
One is granted only to CPAs and AICPA qualified equivalents; the other requires no accounting license and no particular field of study. What follows from that — which professional standard the witness can be measured against — is the part of the letters nobody reads.
September 9, 2026
An empty witness box in a wood-panelled courtroom, late afternoon light falling across a single bound exhibit left on the ledge
Proving the Scheme
Can a forensic accountant testify that someone committed fraud?
No, and the first obstacle is not evidence law. An AICPA member or a Certified Fraud Examiner is barred by their own standards from stating that fraud occurred, and permitted nearly everything short of it.
September 9, 2026
A paper till roll unspooling across a shop counter beside an open cash drawer, late light across the keys
Proving the Scheme
How do you prove money was stolen if it was never recorded anywhere?
Not from the ledger, because a skimming scheme never puts it there. The proof gets built from operational records, counterparty documents and the subject's own financial position, and it is proof by inference, which is exactly where the defense goes.
September 9, 2026
A stack of bank statements fanned across a dark table under a desk lamp, one column of figures marked in pencil
Proving the Scheme
Does a forensic accountant tracing bank records have to be disclosed as an expert?
Two federal circuits answered differently within twelve months. What separated them was not the witness's credentials. It was whether tracing the funds required choosing a method.
September 9, 2026
common questions

What people ask before they retain anyone.

These come before the analysis does. If money may still be moving, the first answer is the one worth acting on this week.

We think money has gone missing. What decays while we decide what to do?
The traceable claim, and it does not recover on its own. Where misappropriated funds are commingled with clean money, courts commonly apply the lowest intermediate balance rule: the claimant’s traceable interest is capped at the lowest balance the account reached after the tainted deposit, and later deposits do not restore it. In re Dameron, 155 F.3d 718, 724 (4th Cir. 1998) puts it flatly — in no case is the trust permitted to be replenished by deposits made subsequent to the lowest intermediate balance, and if the account is depleted entirely the trust is considered lost. LIBR is not the only convention; pro rata, first-in-first-out and last-in-first-out are all applied, and pro rata tends to prevail where many similarly situated victims trace to a single account. But every one of them runs on the account’s balance history, which is why the statements and the underlying deposit items are the first records to secure. Two back-stops sit behind that. Bank Secrecy Act records generally need only be retained five years (31 CFR 1010.430(d)), though many institutions keep them longer. And retention of an accountant through counsel under United States v. Kovel, 296 F.2d 918 (2d Cir. 1961) protects work done to assist counsel in giving legal advice — it does not reach back over work the company already completed on its own, and there is no federal accountant-client privilege to fall back on. So the two cheap moves this week are to get counsel to retain the accountant before the work starts, and to get the bank records before the retention window closes.
Can a forensic accountant tell us whether this was fraud?
Not in those words, and it is worth knowing why before you retain anyone. AICPA Statement on Standards for Forensic Services No. 1 states that because the ultimate decision regarding the occurrence of fraud is determined by a trier of fact, a member performing forensic services is prohibited from opining regarding the ultimate conclusion of fraud. The ACFE draws the same line for certified fraud examiners: no opinion shall be expressed regarding the legal guilt or innocence of any person or party. What the standards permit, though, is almost everything short of the verdict. SSFS No. 1 expressly allows expert opinions on whether evidence is consistent with certain elements of fraud, and the ACFE’s own guidance allows an examiner to conclude that a person misappropriated cash, misrepresented a transaction or concealed funds, and that each element of a statute is satisfied — and to stop there. The finding survives; only the label is withheld. Two caveats, because they matter. These are membership obligations rather than rules of evidence, and they bind AICPA members and CFEs; an expert who is neither is not reached by either document. And an expert who reaches for the label anyway has given opposing counsel a motion to file, because courts regularly strike expert opinions that state legal conclusions — even though Rule 704(a) says an opinion is not objectionable just because it embraces an ultimate issue.
What does the Institute actually do?
It explains what the questions in a fraud or forensic accounting matter are and what evidence they need: how a scheme of this shape would have to have worked and what trail it would leave, what the records can and cannot establish and how they are rebuilt when they are missing, what remains traceable and what the remedy depends on, and whether an investigation was conducted well enough to survive attack. It is a reference and a diagnostic. It also explains what the credentials certify, which is less than most buyers assume — the CFF requires an active CPA license, the CFE requires no accounting license and no particular field of study, and ABV, CVA and ASA are valuation credentials rather than investigative ones, so screening on letters alone can produce an expert who cannot opine on the accounting treatment at issue. The Institute does not investigate live matters, does not say whether a particular person took anything, and does not opine on whether fraud occurred — that last one is the opinion nobody bound by these standards is permitted to give.
Our auditors never found this. Should they have — and can they investigate it now?
Two questions, two different answers. On the first, the standards are more specific than either side usually admits. AU-C 240 for private-company audits, and PCAOB AS 2401 for issuers, place primary responsibility for preventing and detecting fraud on management and those charged with governance, and promise reasonable rather than absolute assurance about material misstatement, whether caused by fraud or error. But reasonable assurance is an affirmative obligation, not a disclaimer, and materiality bounds the auditor in a way that relevance does not bound an examiner. In the ACFE’s Occupational Fraud 2026: A Report to the Nations, external audit was the source of initial detection in 2% of cases, against 15% for internal audit and 43% for tips — which says something about what an audit is built to do rather than settling whether any particular audit fell short. That second question is a standard-of-care question on its own record, and this Institute serves both sides of it. On whether the audit firm can now investigate: where the company is an SEC registrant, its accountant’s independence is impaired by providing expert services advocating the audit client’s interests in litigation or a regulatory proceeding (17 CFR 210.2-01(c)(4)). The narrow thing the auditor may still do is give a factual account of the work it actually performed.
How is the Institute paid?
The orientation and the reference material are free and require no account. Where a party wants the investigative scope, the records analysis or the tracing reviewed independently — ideally before a theory is committed to — that is a private engagement billed as a fixed fee agreed in writing beforehand. Where a matter needs a retained testifying expert, the Institute helps identify the right one through its expert network. It never takes a share of anything recovered. SSFS No. 1 carries a contingent-fee prohibition for forensic services, and quite apart from the standard, a fee that moves with the finding is the first thing a competent cross-examination goes after.
Do you calculate what the fraud cost us?
Some of it — and the line runs by question rather than by profession, which matters, because the same CPA very often does both halves. The AICPA’s CFF body of knowledge includes economic damage calculations and NACVA’s MAFF lists commercial damages and lost profits alongside fraud investigation, so anyone telling you that forensic accountants do not do damages work is simply wrong. The test we apply is different: is this an operation on the historical record, or does it require assuming a world that never happened? Reconstructing what actually moved out of an account, allocating an already-recovered fund among claimants, and testing direct depletion under a fidelity policy are all arithmetic performed on documents that exist, and they are ours. The but-for world — lost profits by any method, business value, apportionment, present value, prejudgment interest — is a model rather than a record, and it belongs to our Economic Damages Institute, which covers those measures properly. The two fit together under Rule 703: the damages expert relies on the reconstructed factual record as the predicate for the model. A matter needing both is often two engagements and sometimes two experts, and it is far cheaper to know that at the outset than at expert disclosure.

Trace first. Freeze second.

Describe the matter. The Institute will help you see what the records could establish and what is decaying while you decide — with no recovery to take a share of.

talk to the Institute
Forensic Conciergeorientation, not a finding of fraud
Tell me roughly what surfaced, how it came to light, and what has happened since. If money may still be moving, the first thing worth establishing is whether the account statements and deposit items have been secured — the traceable claim is set by the account’s balance history, and that only gets worse with time.