The schemes that are hardest to prove are the ones the victim’s accounting records cannot see. Proving those is a different exercise from reading a ledger, and it ends in a courtroom where the constraint is not what the analysis found but what the witness may say about it.
Start a conversation with the Forensic Concierge, already scoped to proving the scheme. Select a subject area to prompt it, or describe the matter directly.
Skimming takes cash before it is recorded, so no entry exists to find and no reconciliation will surface it — which is why a balanced ledger answers nothing, and why proof has to be assembled from operational data and from the other side of the transaction. Cash larceny takes the same money after recording and leaves a difference anyone can see. Corruption is the extreme case: in a kickback or bid-rigging arrangement the money often never touches the victim’s accounts at all, which is why the Justice Department’s own list of what proves collusion is almost entirely non-accounting. Financial statement fraud is the inverse — the trail sits entirely inside the books, in entries, reserves and period-end adjustments. Outside the books, inside them, or nowhere at all: that single question sets the record set, the method and the proof strategy for everything that follows.
What the scheme was, what the records can honestly be made to show, and what the witness is permitted to say about it — in that order, because each one constrains the next.
The taxonomy every practitioner already shares, read for the thing it actually tells you: which records could possibly show the scheme.
investigateThe hard part of this discipline is proving what is absent, and there is an established body of method for doing it.
investigateThe constraint at trial is rarely what the analysis found. It is what the witness is permitted to say about it, and in what words.
investigateThe work that turns an allegation into something a court can receive.
Conduct, mechanics and elements — which is nearly everything short of the verdict. AICPA Statement on Standards for Forensic Services No. 1 ¶10 reserves the ultimate conclusion of fraud to the trier of fact and prohibits a member performing forensic services from opining on it, while expressly permitting ‘expert opinions relating to whether evidence is consistent with certain elements of fraud or other laws based on objective evaluation’. The ACFE Code §V.B.2 draws the same line for certified fraud examiners: ‘No opinion shall be expressed regarding the legal guilt or innocence of any person or party.’ The ACFE’s own guidance then makes the scope clear — an examiner may conclude that a person misappropriated cash, misrepresented a transaction or concealed funds, and may conclude that each element of a fraud statute is satisfied. The finding survives; only the label is withheld.
Because the scheme determines which records could ever have recorded it. An on-book scheme leaves a discrepancy inside the accounting system, so the work is reconciliation, journal entry testing and source-document examination. An off-book scheme leaves nothing, so the work moves to independent operational data and to the counterparty. A corruption scheme frequently leaves nothing in the victim entity at all, so the record set becomes bid documents, travel and expense reports, telephone records and diaries. Choosing the wrong record set is the most expensive error available early in a matter, because preservation notices and third-party subpoenas are aimed at the wrong custodians while the window is open.
Not against an off-book allegation, and this is the most common misreading in the field. The ACFE defines skimming as a scheme in which an incoming payment is stolen before it is recorded on the organization’s books and records. Money that was never recorded produces no entry to flag and no difference to reconcile, so the accounting system will balance perfectly whether or not the scheme ran. Cash larceny — the same theft after recording — does leave a reconciling difference. In Occupational Fraud 2024 the two appeared in 10% of cases each, with medians of $43,000 and $50,000: close in the numbers and completely different in provability, which is why the first question in a cash matter is when the money was taken relative to when it was recorded.
By question, not by profession. Forensic accountants routinely quantify losses — the AICPA’s CFF and NACVA’s MAFF bodies of knowledge both include damages and lost profits work, and the same practitioner very often does both halves. The division here is editorial and subject-matter: this Institute covers operations on the historical record, including what moved and when. Our Economic Damages Institute covers measurement against a but-for state — lost profits, apportionment, present value, event studies. FRE 703 is what lets one matter support both: the damages expert relies on the reconstructed factual record as the predicate for a model, provided experts in the field would reasonably rely on that kind of data.
Not usually a Daubert loss. Three quieter routes account for most of it. The first is a disclosure defect: a Rule 26(a)(2)(B) report that states conclusions without the how and why, met with self-executing exclusion under Rule 37(c)(1). The second is the lay-versus-expert trap — a tracing witness offered as a lay summary witness who, on the Tenth Circuit’s reasoning in United States v. Joseph, 108 F.4th 1273 (10th Cir. 2024), had to choose among competing methodologies and therefore should have been disclosed as an expert. The third is phrasing: an opinion delivered in the statute’s own vocabulary, which is what the Second Circuit set aside in United States v. Scop, 846 F.2d 135 (2d Cir. 1988).
Describe the allegation and what has been preserved. The Institute will help you see which record set the case will actually be built from.