Forensic accounting

With at least one requirement relating to forensic accounting in three out of five Paper P7 exams between December 2011 and December 2013, this is an area of the syllabus that students cannot afford to overlook. This article explores some of the issues relevant to forensic accounting.

Forensic accounting has been a regular feature in the Paper P7 exam in recent sittings but the examiner has commented that it is an inadequately understood part of the syllabus.


The syllabus requires an understanding of three key terms: ‘forensic accounting’, ‘forensic investigation’ and ‘forensic audit’. Recent exam sittings have shown that students have rote-learnt the definitions or meaning of these terms, but do not necessarily understand them.

The terms are not strictly defined in regulatory guidance and the meaning of forensic accounting is quite broad: it is the application of accountancy skills and knowledge in circumstances that have legal consequences. There are many circumstances with legal consequences in which accountancy might be required; the most well known of which is investigating alleged fraudulent activity.

Forensic accounting is the term used to describe the type of engagement. It is the whole process of carrying out a forensic investigation, including preparing an expert’s report or witness statement, and potentially acting as an expert witness in legal proceedings.

Forensic investigation is a part of a forensic accounting engagement. Forensic investigation is the process of gathering evidence so that the expert’s report or witness statement can be prepared. It includes forensic auditing, but incorporates a much broader range of investigative techniques, such as interviewing witnesses and suspects, imaging or recovering computer files including emails, physical searches of premises etc.

Forensic auditing is the application of traditional auditing procedures and techniques in order to gather evidence as part of the forensic investigation.


The major applications of forensic accounting include fraud investigations, negligence cases and insurance claims.

An insurance claim would require determination of how much the client should claim from the insurer. The first step would be a detailed review of the insurance policy to determine ‘coverage’, ie what is insured and any clauses that might restrict the amount that can be claimed or invalidate the claim.

The second step would be to gather evidence to quantify the loss, ie the amount to be claimed. Insurance claims might include claims following misappropriation of assets, ie theft of goods or money. In such cases, the forensic accountant will review inventory or cash records and details of sales and purchases to reconcile the amounts held and determine the value of the goods or cash stolen. They will also test the reliability of the information held by counting a sample of inventory or cash currently held in comparison with the client’s records. The forensic accountant will not assume that there has been a theft; they will consider other possibilities such as an error in the data held.

Insurance claims may however, be much more complicated than this, such as in the case of business interruptions arising as a result of fire or flood. In these types of engagements the forensic accountant will review prospective financial information in comparison with reported outturn to evaluate the loss of profit arising as a result of the business interruption. The forensic accountant will not assume that there has been any loss of profit due to the business interruption; they will consider other possibilities such as a straightforward loss of market share to a competitor.

Forensic engagements often require the forensic accountant to quantify a loss. One such engagement is in professional negligence claims, ie when another accountant has breached their duty of care to a client or third party resulting in a loss for that client. In these types of engagement, the forensic accountant would also provide an opinion on whether the duty of care owed has been breached, ie whether the audit or other accountancy service was performed in accordance with current standards in practice, legislation and techniques. In relation to an audit, this would require consideration of whether the International Standards on Auditing were followed.

The need for a forensic accountant may also arise because two parties cannot agree on the amount owed by one party to another, and the accountant is engaged to provide an expert valuation, of a business for example.

This might be the case in a matrimonial dispute, where a divorcing couple whose assets include shares in a company or partnership, engage a forensic accountant to value the company so that a settlement can be reached. A similar process might apply in partnerships, when one partner wishes to leave the partnership and is being bought out by the remaining partner(s). 

The role of an expert witness

An expert witness is quite different to any other witness in court proceedings. Most witnesses are 'witnesses of fact', ie they can only provide evidence on what they saw, did or heard. Most importantly, they cannot give their opinion on any of the matters about which they give evidence. By contrast, an expert witness is specifically called to give their opinion on a particular matter.

An accountant can be called to give evidence as a professional witness, ie a witness of fact, or an expert witness. In order to give evidence as an expert witness they must be just that, an expert. They must be able to demonstrate a level of expertise that means their opinion is valuable to the court. This means not only expertise in accountancy, but also expertise in the particular area of accountancy that they are giving evidence on.

A witness will provide a written report/statement to the court, and may also be required to attend court to give live evidence, in person, and be cross-examined by the ‘other side’.

However, not all forensic engagements will require evidence to be submitted to a court. Often, the engagement will simply require a report for the client’s own purposes or sometimes a report for use by the insurer.

Either way, a key skill necessary in being a successful forensic accountant is the ability to explain complex accounting concepts in simple terms to someone who is not themselves an accountant, whether that be as an expert witness explaining matters to the judge or jury, or when explaining matters to the client. Forensic accounting integrates investigative, accountancy, and communication skills.


Forensic accounting engagements are agreed-upon procedures engagements, not assurance engagements. The forensic accountant will not provide an assurance opinion – that is the role of the auditor when reviewing the amount of loss included in the financial statements.

This will normally involve determining an appropriate value or quantifying a loss as discussed above; this is quite distinct from an assurance engagement in which the engagement team would review an amount determined by the client.

As an agreed-upon procedures engagement, the forensic accountant will normally prepare a report for the client that sets out their findings, based on the scope agreed in the engagement letter. This report may be addressed to management, often in the case of a fraud, or to the insurer.

It may be that a witness statement/report for submission to the court/arbitrator is required in addition to or instead of a report to the client.

However, planning the investigation is likely to be similar to planning an audit or any other assurance engagement.

Planning will commence with a meeting with the client in which the engagement team will develop an understanding of the issue/events (the fraud, theft etc) and actions taken by the client since it occurred.

A key part of planning is to confirm exactly what format the output is required in, and exactly what matters are required to be covered within it.

At this stage any key documentation will be obtained and scrutinised – for example, the insurance policy, the partnership agreement, the evidence that led to the discovery of the fraud, etc.

The team will agree with the client, what access to other information or personnel will be required and this will be arranged.

Based on the above, the team will design procedures that enable them to meet the requirements of the client, as agreed. This may or may not include test of controls, depending on the circumstances. There would be no need to tests control when valuing a business for a matrimonial dispute. However, testing controls will be key to determining how a fraud took place.

Procedures and evidence

Any method of obtaining evidence can be used in a forensic accounting engagement – this is not a limited assurance engagement in which procedures are likely to be restricted to enquiry and analytical procedures.

Forensic engagements will include a detailed and wholesale review of all documentation and electronic evidence available. The opinion given by the expert accountant must be reasoned, and backed up by evidence. Their opinion cannot be objective if only based on what they are told; they must corroborate that information.

To be awarded marks in the exam, your procedures cannot be vague. They must be specific enough that the engagement team could actually follow your instructions.

For example, it would not be sufficient to write 'interview the suspect'. You must suggest questions that should be asked of the suspect in interview, depending on the circumstances in the scenario. For example, the suspect could be asked to explain their job role and what access that gives them to systems, cash, inventory etc.

This also applies when recommending enquires of or discussions with management – it must be clear in your answer what it is the engagement team should ask of them, eg have they informed the police, has the suspect been suspended, have they informed the insurer etc.

Equally it is not sufficient to suggest the use of computer assisted auditing techniques (CAATs). You must specify how the CAATs could be used. For example, data matching bank accounts used for paying suppliers with bank accounts for paying employees, exception reports identifying employees who are not taking holiday, etc.

In order to design appropriate procedures you must identify the type of forensic accounting engagement, and the specific type of fraud, insurance or negligence claim. For example, quantifying the theft of goods will be very different from quantifying a loss from payroll or ‘ghost employee’ fraud or loss of profits following a business interruption (as discussed above).

Fundamental ethical principles

The range of ethical and professional issues will be similar to any other type of engagement. However, the importance of ethics is arguably much greater in relation to forensic accountancy.  Often both ‘sides’ will bring an expert witness to the hearing where they do not agree. The decision maker must decide which evidence they ‘prefer’ – the credibility of the witness is often the primary factor on which they can base that decision and the credibility of an accountant is reliant on their compliance with the fundamental ethical principles.

In the exam, you will also need to note whether the client requesting the forensic accounting service is an audit client, if so, this will present an additional and particularly important threat to objectivity; a self-review threat. The investigation is likely to involve the quantification of an amount, which will then be reviewed as part of the financial statements audit.  The significance of the threat will be affected by the materiality of the amount and the subjectivity involved in quantifying it, eg if for loss of profits following business interruption this will be more subjective than quantification of the value of stolen inventory.

Remember that the decision to prosecute is a matter for the client. Often, clients do not want to prosecute for fear of damaging their reputation. The forensic accountant can provide the client with an analysis of all of the facts, but must not make the decision to prosecute (a management threat to objectivity). The forensic accountant has a duty of confidentiality, unless it is in the public interest to do so, they must not disclose the fraud to any third party including the police, without client permission.

A final note

Remember that a forensic accountant is just that; an accountant! Their role is to provide an accountant’s expert opinion or analysis of the facts. They are not the law-enforcer, prosecutor or judge. Be careful in the exam not to detract from an otherwise professional answer by getting carried away with suggestions such as taking fingerprints or DNA evidence or blood samples, or catching and punishing the culprit – that is not the role of an accountant.  

Check your understanding

Question: Which of the following would be a valid procedure in a forensic engagement to determine the amount of insurance to be claimed in respect of lost profits during a business interruption following a flood?

  1. Obtain a written confirmation from the insurance provider to verify the amount of the loss.
  2. Recalculate management’s assessment of the loss to verify mathematical accuracy.
  3. Obtain the profit forecast for the period covered by insurance, and cast for mathematical accuracy.

Answer: The assurance provider’s role is to independently quantify the loss in order to determine the amount to be claimed; therefore 1 and 2 are not relevant. They would review the profit forecast in comparison with the actual outturn to determine the amount of profit lost and the first step would be to ensure that it adds up correctly. (Answer 3)

Question: Which of the following would be a valid statement to include in a witness statement from an expert witness, but not a professional witness?

  1. The company’s purchases daybook recorded 15 sales invoices made out in the name of the allegedly fictitious supplier.
  2. The majority of the transactions recorded in the sales day-book do not appear to be commercial in nature.
  3. 75% of customers breached the credit limits set by the company during the period.

Answer: 1 and 3 are a matter of fact, 2 is a matter of opinion. Only an expert witness can give their opinion. A professional witness is a witness of fact who can only comment on what they did, saw or heard. A professional accountancy witness could review a company’s records and comment on what they saw during that review. (Answer 2)

Helen Barrett is a forensic accountant and a freelance lecturer

"To be awarded marks in the exam, your procedures cannot be vague. They must be specific enough that the engagement team could actually follow your instructions."