Reading the records that exist is the easy half. The work that is actually paid for is establishing what the records do not contain, and being honest about how far that reaches.
Start a conversation with the Forensic Concierge, already scoped to records and reconstruction. Pick a starting point, or describe the matter directly.
A reconstruction has two failure modes and they pull in opposite directions. Understate what the record supports and the analysis proves nothing; overstate it and the opinion will not survive the first serious cross-examination. The territory between them is well mapped. Ledger, subledger and ERP data show what the system was told. Adjustments made outside the journals — through consolidating entries, report combinations and reclassifications — show what was done to the numbers afterward, and are where sophisticated financial statement manipulation actually sits. Where nothing was recorded at all, independent operational data and the indirect methods of proof reconstruct from outside the entity. Each of these establishes something specific and stops somewhere specific, and stating where it stops is the part that earns credibility.
Six record layers, ordered roughly by how far they sit from the accounting system.
General ledger, subledgers, and the ERP transaction and audit-trail data underneath them. This layer establishes what the system was told, which is not the same as what happened.
AU-C 240 ¶.A47 describes adjustments to reported amounts ‘not reflected in formal journal entries, such as through consolidating adjustments, report combinations, and reclassifications’. PCAOB AS 2401 is the issuer analogue.
Units sold, inventory consumed, hours billed, customers served. Where an incoming payment was never recorded, the operational side of the business is the only place the transaction left a mark.
Net worth, expenditures and bank deposits — developed by IRS Criminal Investigation and sustained by the Supreme Court in Holland v. United States, 348 U.S. 121 (1954). IRS CI treats the direct, specific-item method as preferred and turns to these when records are missing, inadequate or withheld.
Standard of living measured against known sources, and the ownership and control relationships behind counterparties — who was on the other side of the transaction, and whether that was disclosed.
For issuers, the FCPA accounting provisions at 15 U.S.C. §§ 78m(b)(2)(A) and (B) require books and records that in reasonable detail accurately and fairly reflect transactions, and a system of internal accounting controls — enforceable independently of any bribery element.
How a reconstruction is built so that it holds up.
The reconstruction is the factual predicate everything downstream is built on.
Holland v. United States, 348 U.S. 121 (1954) sustained the net worth method while holding that its dangers require the exercise of great care and restraint, and that jury instructions on it should be especially clear. Indirect methods prove unexplained accretion. They do not prove a particular dollar’s path.
Usually not, but what survives changes what can be established. Records the subject did not control are frequently intact — bank-side documents, counterparty invoices and shipping records, regulator filings, payment processor and operational system data. Where income or assets cannot be tied to specific transactions, the indirect methods reconstruct from the outside: net worth, expenditures and bank deposits. What honesty requires is stating the limit alongside the method. Indirect methods establish that resources appeared without an identified lawful source; they do not identify which dollar came from where. And retention rules impose a real floor — Bank Secrecy Act records generally need only be kept five years under 31 CFR 1010.430(d), though many institutions keep them longer.
Operationally, whether it left a mark in the accounting system at all. AU-C 240 ¶.A47 — the private-company fraud standard; PCAOB AS 2401 governs issuer audits — identifies two mechanisms for manipulating financial reporting: recording inappropriate or unauthorised journal entries during the year or at period end, and making adjustments to reported amounts that are not reflected in formal journal entries, through consolidating adjustments, report combinations and reclassifications. The first is testable from the ledger. The second frequently lives in spreadsheets and consolidation workbooks outside the ERP, which is precisely why it is under-examined and why a document request framed around journal entries alone will miss it. AU-C 240 remains operative until SAS No. 151, approved on 19 August 2026, takes effect for periods ending on or after 15 December 2028.
Only as a starting point. Rule 702 requires that an expert opinion rest on sufficient facts or data, and that requirement bites hardest on inputs the investigator did not generate. Practitioner guidance on challenges to financial experts is blunt: experts who rely too heavily on work done by others, or on data furnished by others such as an attorney or the client, run the risk of exclusion. The most commonly cited grounds for excluding a financial expert remain reliability — insufficient data, or a methodology not generally accepted — and relevance. The practical implication is that a schedule handed over by the party that retained you is not yet evidence of anything; establishing that the inputs are themselves reliable sits with the investigator.
You have established the scheme’s existence and scale, which is a different question from what the loss is worth, though the same practitioner may well answer both. Reconstructing receipts that never reached the accounting system is an operation on the historical record: it shows that money came in and did not arrive. Measuring what the organization would have earned absent the scheme requires assuming a state of affairs that did not occur, which is the work our Economic Damages Institute covers. The two connect cleanly under FRE 703, which lets a damages expert rely on the reconstructed factual record as the predicate for a model, provided experts in the field would reasonably rely on that kind of data.
Describe what exists, what is missing, and who controlled it. The Institute will help you see which reconstruction methods the record can actually support.