Where does the proof come from when the books contain no entry?
From records the scheme never controlled. Where an incoming payment is taken before it reaches the accounting system, the organization’s own ledger contains no entry to examine and no reconciliation will surface a difference, so the proof is assembled from three sources outside the books: operational records created for reasons that have nothing to do with accounting, documents held by the counterparty on the other side of the transaction, and the income and assets of the person whose conduct is in question.
An off-book matter is the ordinary posture in this work rather than an exotic one. The Association of Certified Fraud Examiners’ Occupational Fraud and Abuse Classification System, known as the Fraud Tree, separates schemes that leave an accounting record from schemes that do not, and where no entry was ever created an ordinary accounting review has nothing to test. The uncomfortable consequence is better stated in the engagement letter than in cross-examination: an off-book reconstruction produces proof by inference from independent data, not a traced entry, and a report that presents it as anything else is built to be attacked. Anatomy of fraud schemes sets out the full taxonomy.
What is skimming, and why does no reconciliation catch it?
Skimming is the theft of an incoming payment before that payment is recorded, which is precisely why no reconciliation catches it: the money never enters either side of the comparison. The Association of Certified Fraud Examiners defines skimming as “a scheme in which an incoming payment is stolen from an organization before it is recorded on the organization’s books and records,” and defines cash larceny as the same theft occurring “after it has been recorded” (Occupational Fraud 2026: A Report to the Nations, Glossary of Terminology, p. 106). One word, before or after, decides whether any accounting record of the missing money exists at all.
A reconciliation of recorded receipts against bank deposits is the control that catches cash larceny, because cash larceny removes money the ledger has already recognized and leaves a difference between the two sides. Skimming removes the money from both sides at once, so the two sides agree. That is why the observation that the books balance is not responsive to a skimming allegation: balance is what the scheme produces, not evidence against it. In the ACFE’s Occupational Fraud 2026: A Report to the Nations, the two schemes are close to indistinguishable statistically — skimming appeared in 9% of cases and cash larceny in 8%, at an identical median loss of $45,000 each (Fig. 5, p. 15). They are nowhere near indistinguishable in provability, and which of the two is alleged determines the whole proof strategy and the whole defense.
What records can show revenue that was never recorded in the first place?
The records that can show it are the ones the operation generates for its own purposes rather than for the accounting function: physical inventory counts set against the inventory ledger, goods-outward and delivery documentation, point-of-sale device logs including voids and no-sale openings, appointment and booking systems, metered or consumption data, and statements produced by third parties such as card acquirers, payers and royalty counterparties. Practitioner guidance on skimming makes the inventory version of the point directly: where “the customer receives goods but no sale is recorded, skimming will cause a discrepancy between physical inventory counts and what’s reported in the company’s inventory ledger.” The Fraud Tree splits sales skimming into unrecorded sales and understated sales, and the two behave differently under this kind of testing, because an unrecorded sale is absent altogether while an understated sale is present at the wrong amount.
Every comparison between an operational quantity and revenue rests on an assumed relationship between the two, and that assumption, rather than the arithmetic sitting on top of it, is the contested part of the analysis. Shrinkage, breakage, samples, warranty replacements, comped or written-off goods, changes in product mix and seasonality all move the ratio for reasons unconnected to anyone’s conduct, and a competent opposing expert goes there first. The discipline is to state each assumption on the face of the work, quantify the alternative explanations rather than leave them unaddressed, and keep the conclusion inside what the data will carry. The ACFE’s Interpretation and Guidance to its Code of Professional Standards supplies a usable check at Section III.C.2: evidence is sufficient “where the weight of the evidence is such that a reasonable professional could draw the same or a similar conclusion to that of the member,” and “the fact that two professionals might draw different conclusions based on the same evidence does not necessarily mean that one of the experts has acted on insufficient evidence.” Records and reconstruction goes through the record sets in detail.
How do you prove theft from the alleged perpetrator's side rather than the victim's?
By reconstructing that person’s income from what was accumulated, spent and deposited, using the three indirect methods of proof: the net worth method, the expenditures method and the bank deposits method. The net worth method compares assets less liabilities at the start and end of each year, adds personal expenditures and non-deductible losses, and subtracts non-taxable receipts, arriving at a corrected income figure that can be set against what was reported. The expenditures method is the variant for a subject who spends rather than accumulates, and Internal Revenue Manual 9.5.9 puts the logic plainly: if expenditures for a year “exceed his/her reported income, and the source of the funds used to make the expenditures is unexplained, it may be inferred that such expenditures represent unreported income.” The bank deposits method totals deposits across all accounts, adds currency expenditures and any increase in cash on hand, then subtracts non-income deposits and items such as transfers between accounts, redeposits, loan proceeds and gifts received.
None of the three is the first choice. IRS Criminal Investigation treats the direct specific-item method as its preferred method of proof — Internal Revenue Manual 9.5.9 calls it “the most direct method of proving unreported income” — and turns to the indirect methods where the subject keeps no books, the records are unavailable or inadequate, or the subject withholds them. That sequencing matters on cross-examination, because it means an indirect reconstruction is on the record as a second-best method chosen for a documented reason, and the reason should be documented.
Holland v. United States, 348 U.S. 121 (1954), sustained the net worth method and set the limits on it in the same opinion. The Supreme Court held that “while we cannot say that these pitfalls inherent in the net worth method foreclose its use, they do require the exercise of great care and restraint,” and directed that charges “should be especially clear, including, in addition to the formal instructions, a summary of the nature of the net worth method, the assumptions on which it rests, and the inferences available both for and against the accused.” That approval was given in a tax prosecution, and it is worth not stretching it further than it goes. The honest framing of what these methods deliver is that they establish an unexplained accretion of wealth, not the route of any particular dollar.
A related and frequently skipped point sits underneath all three methods: a bank statement establishes that a deposit happened, not where the deposited money came from. The US Department of Justice’s Subpoena for Bank Records Checklist lists “Deposit Tickets” and “Checks In Deposit” as line items separate from “Monthly Statements,” and it is those deposit items, the instruments themselves, that identify a deposit’s source. An analysis built on statements alone has a gap in it that opposing counsel will find.
What if the money never went through the victim organization's accounts at all?
Where the money never passes through the victim organization’s accounts, that organization’s general ledger is the wrong place to look, and the case is built from records that are not accounting records. In a kickback or bid-rigging matter the payment often moves between third parties, and the US Department of Justice’s Antitrust Division states in its own primer that collusive agreements “can be established either by direct evidence, such as the testimony of a participant, or by circumstantial evidence, such as suspicious bid patterns, travel and expense reports, telephone records, and business diary entries.” Almost nothing on that list is an accounting record.
The Antitrust Division primer also lists document-level indicators that are physical rather than financial: bid forms from different vendors containing “identical calculations or spelling errors” or “similar handwriting, typeface, or stationery”; bid or price documents containing “whiteouts or other physical alterations indicating last-minute price changes”; a company requesting a bid package for itself and a competitor. The primer then does what a red-flag checklist almost never does, which is state the limit of its own list: “While these indicators may arouse suspicion of collusion, they are not proof of collusion.”
The primer’s own example is that a bidder may lawfully submit an intentionally high bid it does not expect to win for its own independent business reasons, such as being too busy to handle the work but wanting to stay on the bidders’ list — indicators, it concludes, “merely call for further investigation.” Indicators of that kind can support predication for an examination. They do not establish liability, and an investigation that treats them as though they do has a problem at its foundation. Conducting the investigation covers where that threshold sits.
What can a forensic accountant actually conclude at the end of an off-book investigation?
An expert bound by the AICPA or ACFE standards can state what the records show about conduct, up to and including that each element of a fraud statute is satisfied, and must stop before the verdict. AICPA Statement on Standards for Forensic Services No. 1 provides at paragraph 10 that “the ultimate decision regarding the occurrence of fraud is determined by a trier of fact; therefore, a member performing forensic services is prohibited from opining regarding the ultimate conclusion of fraud,” while expressly permitting “expert opinions relating to whether evidence is consistent with certain elements of fraud or other laws based on objective evaluation.” The ACFE Code of Professional Standards draws the same line at Section V.B.2: “No opinion shall be expressed regarding the legal guilt or innocence of any person or party.”
The line runs between conduct and legal guilt, and it is considerably more permissive than it is usually reported to be. The ACFE’s Interpretation and Guidance to its Code states that it is permissible for a fraud examination report to include conclusions “that a person misappropriated cash, misrepresented a transaction, concealed funds and so on,” that a Certified Fraud Examiner may work through a fraud statute element by element on the evidence, and that “this is where the CFE’s conclusions must stop.”
Both documents are membership obligations rather than rules of evidence. They bind AICPA members and Certified Fraud Examiners rather than every witness who takes the stand, and Statement on Standards for Forensic Services No. 1 turns on the purpose for which the member was engaged rather than the skill set employed (paragraph 3), reaching neither work performed under the attest or tax standards (paragraph 2) nor an internal assignment given to an employee member who is not in public practice (paragraph 5).
One further boundary is worth naming while the reconstruction is being scoped. Establishing the scale of what moved is proof of the scheme and is squarely this work; measuring what the organization would have earned had the scheme never occurred is a counterfactual model, and that question is developed at the Economic Damages Institute. That is a division of subject matter rather than of profession — the same practitioner very often does both halves, and the AICPA and NACVA bodies of knowledge both include damages work. Federal Rule of Evidence 703 is what lets a single case carry both, since a damages expert may rely on a reconstructed factual record where experts in the field would reasonably rely on that kind of data.