When to Hire a Forensic Accountant for Suspected Employee Theft or Embezzlement

Executive Summary

Joey Friedman, CPA, P.A. is a litigation-focused forensic accounting and business valuation firm engaged by counsel, owners, boards and insurers to establish what happened inside a set of financial records. In an employee theft or embezzlement matter the work is narrow and concrete: determine whether funds were diverted, quantify how much, identify the mechanism, and document it so that it can be presented to a court, a board, an insurer or a prosecutor.

Mr. Friedman has testified in state, federal and foreign courts, for plaintiffs and defendants, in civil, criminal and marital proceedings. The firm works nationwide, performs records-based analysis remotely, and travels for deposition and trial testimony as a matter requires. The firm does not prepare income tax returns and does not provide tax planning services. The firm is engaged by counsel in matters across the United States; see states served for what changes, state by state, in the financial analysis.

When This Issue Arises

Occupational fraud is usually discovered as a discrepancy, not as a confession. These are the situations in which owners and counsel most often engage a forensic accountant:

• A reconciliation will not close. Bank balances and book balances diverge and the difference does not resolve, or resolves only when one person explains it.
• Deposits do not match reported sales. Recorded revenue and money actually banked move independently of each other.
• A vendor nobody can identify. Payments leave the business to a payee no employee recognises, or to an entity that cannot be found in any state registry.
• One person controls a whole cycle. The same employee opens the mail, records the receivable, makes the deposit and reconciles the account — no second pair of eyes anywhere in the chain.
• Resistance to oversight. A long-trusted employee objects to a review of their own area, declines to take vacation, or is the only person who understands a particular system.
• Lifestyle that outruns compensation. Spending visibly exceeds what the position pays, with no other explanation.
• Payroll that does not match the workforce. More people on the payroll register than in the building.
• Write-offs and credits that cluster. Customer credits, refunds or bad-debt write-offs concentrated under one approver.

Any one of these can have an innocent explanation. That is precisely why the analysis matters: the purpose of a forensic engagement is as much to rule a concern out as to prove it, and a documented exclusion protects an innocent employee as much as it protects the business.

Accepted Methods and Frameworks

The firm applies a standard set of detection routines to the records rather than working from suspicion. Each is chosen for the scheme it is capable of surfacing.

Digit-frequency analysis

Applied to ledgers with a sufficient volume of transactions, the expected distribution of leading digits in naturally occurring financial data is known. A material departure from it identifies where to look — it is a targeting tool, not a conclusion.

Ghost-employee testing

Payroll registers are tested against the employee master and against the underlying identifiers — duplicated identification numbers, missing or shared addresses, and direct-deposit detail that overlaps with an approver’s own.

Shell and fictitious vendor testing

The vendor master is tested against state corporate registries and against the payment history. A payee that receives funds but exists in no registry, has no physical presence, or shares an address or bank account with an employee is the classic fictitious-vendor pattern.

Duplicate payment detection

Disbursement ledgers are screened for the same amount to the same payee within a narrow window — a pattern that distinguishes a genuine control failure from a deliberate diversion.

Rounding and whole-dollar pattern analysis

An unusual concentration of round-number amounts, particularly sitting just below an approval threshold, is a recognised indicator of amounts being chosen by a person rather than generated by a transaction.

Timing analysis

Transactions clustered immediately before a period close, an audit or a filing date are isolated and examined separately.

Asset tracing and fund-flow reconstruction

Where funds have left the business, movement is followed through business accounts, related entities and personal accounts to establish where money went and what remains recoverable.

Documents and Data Checklist

An engagement moves faster and costs less when the following are available at the outset. Incomplete records do not prevent the work; they change its sequence.

• Bank statements with cancelled check images and deposit detail, for the full period under review
• The general ledger and trial balance, in native or exportable form rather than as printed reports
• Accounts payable detail and the complete vendor master, including addresses and payment instructions
• Accounts receivable detail, together with credit memos and write-off approvals
• Payroll registers and the employee master
• Credit card statements for every company card
• Merchant processor and point-of-sale settlement reports
• Any prior internal review, auditor communication or insurance claim on the same subject

Common Pitfalls and Rebuttal Strategies

• Confronting the employee first. An early confrontation routinely precedes the deletion of records and the closing of accounts. Secure the data before anyone is interviewed.
• Working from printed reports. A PDF of a ledger cannot be tested. Native data can, and the difference decides whether digit, duplicate and timing analysis are available at all.
• Quantifying from the largest item. A loss extrapolated from one discovered transaction will not survive cross-examination. The figure has to be built from the records.
• Ignoring the insurance clock. Employee dishonesty and fidelity coverage carries notice deadlines and proof-of-loss requirements that are frequently missed while an internal review proceeds informally.
• Treating a control weakness as proof. Poor segregation of duties creates opportunity; it does not establish that anything happened. The two must be reported separately.

What an Engagement Costs

Cost in these matters is driven by the volume and condition of the records, the number of accounts and entities involved, the length of the period under review, and whether testimony is required. Engagements are typically structured hourly against a retainer, with the scope staged so that an initial assessment can establish whether a full investigation is warranted before a larger commitment is made. Where a concern is ruled out at the assessment stage, that is a successful outcome and a far less expensive one.

Frequently Asked Questions

How is a forensic accountant different from my auditor?

An audit is designed to express an opinion on whether financial statements are fairly stated, using sampling. A forensic engagement is designed to establish what happened in a specific set of transactions, and is built to be defended in a proceeding. An audit that found nothing does not mean nothing occurred.

Do I need proof before I call?

No. A concrete reason is enough — a discrepancy that will not resolve, a payee nobody recognises, a pattern that does not fit. Part of the purpose of the work is to determine whether a concern is well founded.

Should I report it to law enforcement first?

That is a legal decision for counsel, not an accounting one, and it is usually better made once the facts are documented. A referral supported by a quantified, records-based analysis is materially more likely to be acted on than one based on suspicion.

How long does an investigation take?

It depends almost entirely on the condition of the records and how quickly they are produced. Complete, native-format data shortens the work substantially; reconstructing from incomplete records lengthens it.

Can the money be recovered?

Sometimes. Recovery generally depends on what the funds were converted into, whether assets remain traceable, and whether insurance coverage applies. Tracing establishes what is available to pursue; it does not guarantee collection.

Will my insurance cover the loss?

Employee dishonesty and fidelity policies often do, subject to their own terms, notice deadlines and proof-of-loss requirements. Those requirements typically call for exactly the kind of documented quantification a forensic engagement produces, which is a reason to start early rather than late.

What if the amount turns out to be small?

The amount discovered is frequently not the amount at issue. A small identified loss that reveals a control failure open for years is a different problem from an isolated incident, and the distinction is one the analysis is designed to draw.

What qualifications should the expert have?

For matters that may reach a proceeding, the relevant considerations are accounting credentials, experience with the specific analysis at issue, and a record of testifying and surviving cross-examination. Mr. Friedman is a CPA accredited in Business Valuation (ABV) by the AICPA and a member of the Association of Certified Fraud Examiners.

Discuss a Suspected Theft

Joey Friedman is a CPA accredited in Business Valuation (ABV) by the AICPA, a member of the Association of Certified Fraud Examiners, with more than 25 years in accounting and forensic practice and an expert witness practice serving attorneys, owners and litigants nationwide since 2014. To discuss whether a forensic engagement is warranted — including scope, sequencing and what to secure before anyone is interviewed — call 954-282-9615 or use the contact form.