An auditor may not assume an allegation. An examiner may not proceed without one. Almost every attack on an investigation starts at that difference.
Start a conversation with the Forensic Concierge, already scoped to conducting the investigation. Pick a starting point, or describe the matter directly.
A fraud examination begins where an audit cannot: with an allegation. The ACFE Code requires the examiner to establish predication and scope priorities at the outset and to reevaluate them continuously as the examination proceeds — a threshold condition with no analogue in auditing, and the reason an examination that went looking first is attackable before a single document is pulled. The same code requires the examiner to consider both exculpatory and inculpatory evidence, which is the strongest single line against a whitewashed investigation and against an over-aggressive one alike. Add evidence control, a sufficiency test that is expressly not a contest over who is right, and the four general standards SSFS No. 1 imports, and the whole enforceable checklist fits on a page.
Six requirements taken from the codes themselves, each of which becomes an attack surface when it is missing.
ACFE §IV.A.2 requires predication and scope priorities at the outset and continuous reevaluation. The guidance describes it as the totality of circumstances that would lead a reasonable, professionally trained and prudent individual to believe a fraud has occurred, is occurring or will occur.
An indicator is not a finding. The Department of Justice says of its own collusion indicators that they are not proof of collusion, and the same discipline applies to every red-flag list in this field.
ACFE §IV.A.3 requires alertness to conjecture, unsubstantiated opinion and witness bias, and requires the examiner to consider both exculpatory and inculpatory evidence. A one-directional file departs from the standard on its face.
ACFE §IV.B.1 requires control and management procedures for documents, data and other evidence, and awareness of the chain of custody — origin, possession and disposition. A standards obligation, not housekeeping.
ACFE §III.C.2 asks whether the weight of evidence is such that a reasonable professional could draw a similar conclusion. Its guidance adds that two professionals differing does not mean one acted on insufficient evidence.
SSFS No. 1 ¶7 requires integrity and objectivity and forbids subordinating the opinion to any other party. Independence is not required — forensic services are non-attest, and retention by one side is proper.
The working sequence, in which the order matters more than any single step.
This is where investigations are actually attacked, and both sides use the same texts.
It tests distributions rather than transactions. It does not apply to assigned numbers such as invoice or check numbers, breaks down where a floor or ceiling constrains the data, and produces false positives below roughly five thousand entries. A single large theft is invisible to it. It is triage, and nothing it produces is a finding.
It is the threshold condition for beginning a fraud examination, and it has no analogue in auditing. ACFE §IV.A.2 requires the examiner to establish predication and scope priorities at the outset and to continuously reevaluate them as the examination proceeds; the guidance describes predication as the totality of circumstances that would lead a reasonable, professionally trained and prudent individual to believe a fraud has occurred, is occurring or will occur. An auditor begins with no allegation and must treat fraud as always possible. An examiner may not begin without one. That is why an examination which started as a look around, or which quietly expanded past what justified it, is attackable on the standard rather than on the facts — and the guidance is equally clear that predication is not required for a risk assessment or a consulting engagement.
Usually on four things, roughly in this order. Whether predication existed and whether each step stayed inside it. Whether exculpatory evidence was sought and weighed, which ACFE §IV.A.3 requires in terms and which cuts against a whitewash and an over-reach equally. Whether evidence was controlled — §IV.B.1 makes chain of custody, meaning origin, possession and disposition, a standards obligation. And whether the conclusions rest on sufficient relevant data, one of the four AICPA general standards SSFS No. 1 imports. Note what is not on that list: report format. ACFE §V.A.1 prescribes no structure and permits an oral report, requiring only that it not be misleading — which pushes the attack onto substance and scope, where it belongs.
No, and confusing this with auditing costs people arguments they could have won. Forensic services are non-attest. SSFS No. 1 ¶7 requires integrity and objectivity and provides that the member should not subordinate their opinion to any other party; ¶8 imports the Code's definitions, under which integrity can accommodate an honest difference of opinion but not deceit or subordination of principle, and objectivity imposes impartiality, intellectual honesty and freedom from conflicts. Being retained by one side is entirely proper. The real line is between advocating for a party, which is improper, and advocating for one's own opinion, which is the job. It is the auditor, not the forensic accountant, who faces an independence bar under the SEC's rules.
Analytics narrows populations; it does not identify people, and material claiming otherwise rarely survives a competent cross-examination. Journal entry and other-adjustment testing, vendor master file analysis and disbursement testing are population-narrowing techniques whose output is a set of items warranting examination. Benford's Law is the clearest illustration of the limit: it tests digit distributions rather than individual transactions, does not apply to assigned numbers, and cannot see a one-off theft at all. Findings come from the underlying documents, the interviews and the surrounding record. And whatever the file establishes, neither the AICPA nor the ACFE permits their members to state the ultimate conclusion of fraud or to opine on legal guilt — the permitted formulation is that the evidence is or is not consistent with specified elements.
Describe what was examined, in what order, and on what basis. The Institute will help you see where these investigations usually give way.