The audit was never the fraud-detection function, and the standards say so in their own words. That vacuum is why somebody independent has to go and reconstruct what happened.
Start a conversation with the Forensic Concierge, already scoped to detection & investigation. Select a subject area to prompt it, or describe the matter directly.
Occupational fraud most often comes to light because somebody reports it. In the ACFE's 2026 Report to the Nations, tips were the source of initial detection in 43% of cases, internal audit in 15%, and external audit in just 2% — which is less an indictment of auditors than a description of what an audit is scoped to do. AU-C 240, the private-company standard, puts primary responsibility for preventing and detecting fraud on management and those charged with governance, and commits the auditor to reasonable assurance about material misstatement, whether caused by fraud or error. Issuer audits run on PCAOB AS 2401. Either way the matter arrives as an allegation, and someone independent has to reconstruct the record. Who retains that person, on what predication, and what was preserved before anyone was interviewed is what opposing counsel will test later.
How the matter surfaced, who is asking and on whose behalf, and whether the asking was competently done — three different rulebooks, in that order.
The audit is not the fraud-detection function — and that is not a defense of auditors, because reasonable assurance is an obligation, not a disclaimer.
investigateWho signs the engagement letter determines more about the outcome than anything the accountant subsequently finds.
investigateWhere investigations are actually attacked — and both sides work from the same few pages of the ACFE Code and SSFS No. 1.
investigateWhat actually happens between an allegation arriving and an evidentiary record existing.
That question only has an answer once it is attached to a specific requirement, and to the right standard — AU-C 240 for a private-company audit, PCAOB AS 2401 for an issuer. AU-C 240 ¶.04 puts primary responsibility for prevention and detection on management and those charged with governance; ¶.05 concedes that some material misstatements may go undetected even in a properly planned and performed audit; ¶.06 explains why, naming forgery, deliberate failure to record transactions and intentional misrepresentation, and adding that collusion can make false audit evidence look persuasive. Non-detection alone therefore establishes nothing. The other half is equally citable: reasonable assurance is an affirmative obligation rather than a disclaimer, and SEC Acting Chief Accountant Paul Munter said on 11 October 2022 that he found it deeply concerning when auditors frame the discussion of their responsibilities around what lies beyond them. The workable question is narrower — was a required procedure performed, and does the file show it.
You can, and you should understand what it costs before you do. Most jurisdictions recognize no accountant-client privilege, and the federal courts recognize none at all, so an investigation the company runs on its own may simply be discoverable. Retention by counsel, with the accountant working as counsel's agent under a Kovel arrangement, is what supports a privilege argument — and it protects work done to assist counsel in giving legal advice, not work already finished before counsel arrived. For an SEC registrant there is a second constraint: the company's own audit firm is generally barred from providing expert services advocating the client's interests in litigation or a regulatory proceeding, though it may still describe factually the work it performed.
A competent one will not, and the reason is worth knowing before you retain anyone. AICPA SSFS No. 1 ¶10 reserves the ultimate conclusion of fraud to the trier of fact and prohibits a member performing forensic services from opining on it, while expressly permitting opinions on whether evidence is consistent with certain elements. The ACFE draws the same line for certified fraud examiners, barring any opinion on the legal guilt or innocence of any person or party. What survives is nearly everything short of the verdict: the ACFE's own guidance allows an examiner to conclude that a person misappropriated cash, misrepresented a transaction or concealed funds, and to conclude each statutory element is satisfied. The finding survives. Only the label is withheld.
Earlier than most matters begin, for reasons that are structural rather than promotional. Records degrade on schedules nobody controls: Bank Secrecy Act records generally need only be retained five years (31 CFR 1010.430(d)), which is a practical floor rather than a guarantee — many institutions keep them longer, but nothing requires it. And where funds are commingled, courts commonly cap a traceable claim at the lowest balance the account reached afterward, which later deposits do not restore. Kovel protection cannot be applied retroactively to work already done. Devices get reissued and mailboxes get purged on ordinary retention cycles. And early involvement is what shapes which data gets preserved, which documents get requested and which witnesses get asked which questions — the thin, unverified record that draws a sufficiency attack is usually the product of a late start rather than a bad analyst.
They answer different questions and most serious matters need both. This Institute covers the record and the conduct — what happened, how the scheme worked, where the money went, and whether the investigation was competently performed. Our Economic Damages Institute covers the counterfactual — what the loss is worth, lost profits, apportionment, present value, loss causation. The mechanism that makes them complements rather than competitors is Rule 703: a damages expert may rely on the forensic accountant's reconstructed factual record as the predicate for a model, provided experts in the field would reasonably rely on that kind of data. One case, two questions — and often one accountant, since the CFF and MAFF bodies of knowledge both include damages and lost profits. The boundary is by question, never by profession.
Describe how the allegation surfaced and who is asking. The Institute will help you see what the first fortnight has to get right.