Regulatory Compliance & Internal Controls
Every incident traces back to a control that was absent, overridden or never tested. Remediation is where an investigation stops being a cost and starts being an investment.
Explore
Service 05: Risk & Forensics
Risk advisory & forensic accounting
Structured risk assessment before something goes wrong, and disciplined, defensible forensic work when it already has. Led by a Managing Partner whose named specialties are risk assessment and forensic accounting.
At a glance
- Scoping phase: 1 to 2 weeks
- Method: full population, not sampling
- Output: evidence built to withstand challenge
- Fee: fixed per phase, scoped in stages
- Confidentiality: engaged through counsel where appropriate
Urgent
If you suspect something right now
How the first forty-eight hours are handled materially affects whether the eventual findings are usable in an insurance claim or a prosecution. Four things, in this order.
-
Step 01
Do not confront the person
Confrontation is the single most common cause of evidence destruction. It also creates employment law exposure before you know what you are alleging.
-
Step 02
Preserve the evidence
Secure backups of accounting data, email and relevant systems, and suspend routine deletion and retention policies immediately. Do this before anyone knows an inquiry exists.
-
Step 03
Restrict access quietly
Limit the individual's system access, ideally as part of a broader access review, so the change does not itself signal that something is under way.
-
Step 04
Call counsel and a forensic accountant
The same day. Engaging us through your attorney can preserve privilege over the work product, which is a decision that must be made at the start rather than retrofitted.
Two halves
Before, and after
This service line exists in two modes. One is preventative and planned. The other is reactive and urgent. They use the same skills and almost never the same clients, because most businesses only discover the first once they have paid for the second.
Before: risk advisory
Structured identification of what could go wrong, how likely it is, what it would cost, and which of those risks you are currently doing nothing about.
- Enterprise risk assessment and risk register
- Fraud risk assessment by scheme type
- Proactive data analytics over the full ledger
- Third-party and vendor risk review
- Business continuity and key-person exposure
After: forensic accounting
Establishing what happened, over what period, to what value, by whom, to an evidentiary standard that survives challenge.
- Fraud and misappropriation investigation
- General ledger forensic analysis
- Whistleblower complaint response
- Insurance claim quantification
- Litigation and dispute support
Scope
What we perform
Every engagement is scoped in phases. We will not quote a full investigation before establishing whether the exposure is eight thousand dollars or eight hundred thousand.
01
Enterprise risk assessment
A structured review of financial, operational, compliance, technology and key-person risk, producing a risk register scored by likelihood and impact, and, crucially, identifying which material risks currently have no owner and no mitigation.
02
Fraud risk assessment
Assessment against the specific scheme types that affect your business model (billing schemes, payroll schemes, expense reimbursement, check tampering, skimming, inventory theft, financial statement manipulation) and whether existing controls would realistically detect each.
03
Proactive ledger analytics
Analytical testing across the complete transaction population rather than a sample: duplicate payments, round-number journals, entries posted outside business hours, vendor and employee address matches, payments clustered just below approval thresholds, and Benford's Law distribution analysis.
04
Fraud & misappropriation investigation
Full investigation from allegation to report: evidence preservation, transaction tracing to source documents and bank records, quantification of loss by period, identification of the control failure that allowed it, and a written report structured for insurance, counsel or law enforcement use.
05
Whistleblower response
Independent, documented investigation of complaints raised through a hotline, a board member or a regulator, conducted so the process itself withstands scrutiny, which matters as much as the finding when a retaliation claim follows.
06
Litigation & dispute support
Economic damages quantification, lost profits analysis, business valuation input, forensic analysis of the opposing party's records, expert report preparation and deposition support, working under the direction of your counsel.
07
Insurance claim quantification
Loss quantification for employee dishonesty, crime and fidelity claims, prepared to the evidentiary standard carriers require. Weak documentation is the most common reason a legitimate claim is reduced or denied.
08
Post-incident remediation
Every incident traces back to a control that was absent, overridden or never tested. We identify which one, design the fix, and re-test it, so the answer to "could this happen again" is evidenced rather than hoped.
What this does not include
Legal advice or legal representation (we work alongside your counsel, not instead of them), digital forensics and device imaging (we coordinate with specialist digital forensic firms), surveillance or covert investigation, and criminal prosecution. That decision and process belongs with law enforcement.
Indicators
What we look for first
None of these is proof of anything on its own. Two or three together, in the same area, by the same person, are worth a conversation.
| Indicator | Why it matters |
|---|---|
| Post-close manual journals | Especially round numbers, or entries posted by someone outside the accounting function. Most financial statement manipulation runs through manual journals. |
| Vendor bank detail changes | A change to remittance details shortly before a large payment is the classic business email compromise pattern, and the most common single loss event we see. |
| Vendor address matches an employee | A vendor whose address, bank account or tax ID matches an employee record is the signature of a fictitious vendor scheme. |
| Payments just under a threshold | Once is coincidence. A pattern of payments at $4,950 against a $5,000 approval threshold is deliberate structuring. |
| Rising credit memos or write-offs | Particularly when concentrated with one person or one customer. A common way to conceal skimming of receipts. |
| A reconciling item that never clears | An unexplained difference that persists but changes value each month is often a plug hiding a real, growing gap. |
| An employee who never takes leave | Uncomfortable but statistically meaningful. Many schemes require continuous presence to sustain the concealment. |
Each of these is explained in detail in Red Flags in the General Ledger: What Forensic Accountants Look For First.
Engagement
How an investigation runs
Phased deliberately, so cost stays proportionate to what is actually found. You can stop after phase one if the answer turns out to be an error rather than an act.
Phase 01
Preserve & scope
Evidence secured, access reviewed, and a one-to-two week analysis establishing whether there is a genuine issue, its approximate scale and the likely period. Only then is the full investigation quoted.
Phase 02
Investigate
Full population analysis, transaction tracing to source documents and bank records, and interviews where appropriate, conducted so the process itself withstands later challenge.
Phase 03
Quantify & report
Loss quantified by period and by scheme, control failure identified, and a written report produced in the form counsel, the insurer or law enforcement will actually need.
Phase 04
Remediate
The control that failed is redesigned, implemented and re-tested, so the answer to "could this happen again" is evidenced rather than assumed.
Questions
Risk & forensic accounting FAQ
An audit gives reasonable assurance that financial statements are free of material misstatement. It uses sampling, sets a materiality threshold, and is explicitly not designed to detect fraud, particularly fraud below materiality, or concealed through collusion or management override.
A forensic engagement starts from a specific allegation or anomaly, examines complete populations rather than samples, follows individual transactions to source documents and bank records, and produces evidence intended to withstand challenge in a legal or insurance proceeding. Different purpose, different method, different standard of proof.
Four things, in this order, before anything else:
- Do not confront the person. Confrontation is the most common cause of evidence destruction, and it creates employment law exposure before you know what you are alleging.
- Preserve the evidence. Secure system backups, email and accounting data, and suspend routine deletion policies.
- Restrict access quietly, ideally within a broader access review, so it does not itself signal suspicion.
- Call your attorney and a forensic accountant the same day. Engaging us through counsel can preserve privilege over the work product, and that decision has to be made at the start.
Investigations are scoped in phases so the cost stays proportionate to what is actually found.
Phase one is a scoping and preservation review, typically one to two weeks, establishing whether there is a genuine issue, its approximate scale and the likely period. Only then do we quote the full investigation. Quoting one before knowing whether the exposure is $8,000 or $800,000 produces a number useless to both sides. Each phase carries a fixed fee, and you can stop after phase one if the answer turns out to be an error rather than an act.
The recurring ones are manual journals posted after close, especially round numbers or entries by someone outside accounting; vendors whose bank details changed shortly before a large payment; vendor addresses matching an employee address; payments repeatedly just below an approval threshold; a rising volume of credit memos or write-offs concentrated with one person; expense reimbursements that consistently avoid the receipt threshold; and a reconciling item that never clears but changes value each month.
None is proof on its own. Two or three together, in the same area, by the same person, are worth a conversation.
We provide litigation and dispute support (economic damages quantification, forensic analysis, expert reports and deposition support), working under the direction of your counsel.
Where a matter requires testifying expert work at trial, we scope that explicitly at the outset. A consulting expert and a testifying expert carry different disclosure consequences, and that decision belongs with your attorney at the beginning of the matter rather than in the middle of it.
Related services
Often engaged together
Audit & Assurance
An audit is not a fraud detection instrument. Understanding what your audit does and does not cover is the first step in knowing what is left uncovered.
Explore
Accounting & Bookkeeping
A disciplined close with genuine reconciliations is itself a detective control. Most schemes we investigate ran undetected because nothing was reconciled independently.
Explore
Confidential
A conversation costs nothing and changes what is possible
If something in the numbers is not sitting right, the earliest call is always the cheapest one. We can speak confidentially, and where appropriate be engaged through your attorney so the work product is protected from the outset.