Embezzlement investigation support

The engagement covers tracing every suspected transaction to its underlying bank record, invoice, receipt, or payroll entry, building a period-by-period schedule of the amount diverted with the estimation method shown on the face of the schedule, and separating confirmed loss (fully documented) from amounts still under review (a pattern exists but a document is missing or a legitimate explanation has not been ruled out). We also reconcile the vendor master file and payroll roster against actual employees and approved vendors, since ghost vendors and ghost employees are two of the most common mechanisms. The deliverable package includes a narrative summary, the supporting schedules, and an index mapping each schedule line back to its source document, so anyone reviewing the file later, an insurer, a new attorney, a second forensic accountant, can pick it up without reconstructing the trail from scratch.

We start with an intake call covering what triggered the suspicion, which accounts and systems are in scope, and whether the person suspected still has active access to the books (if so, we talk through locking that down first). We then pull bank statements, card statements, payroll records, and the accounting file for the period in question, and begin tracing the flagged pattern transaction by transaction. As the trace develops we build the loss schedule in parallel, updating it as new documents surface or as an item that looked suspicious turns out to have a legitimate explanation. A senior reviewer reviews the schedule before it goes to you, checking that every figure ties to a document and that the estimation method for any extrapolated period is defensible and clearly stated.

Business owners who have spotted a pattern they cannot explain, whether that is cash that never seems to reconcile, a bookkeeper who resists handing over access, or a spouse or partner asking pointed questions about a company account. It is also for attorneys who need the accounting workpapers behind a civil claim or a criminal referral, boards responding to a whistleblower complaint, and insurers evaluating a fidelity bond or employee dishonesty claim who need an independent trace before they authorize payment. It is not for a routine bookkeeping cleanup with no suspected diversion; that is ordinary catch-up bookkeeping, priced and scoped differently.

The most common starting point is a bookkeeper or office manager with sole control over both the checkbook and the reconciliation, which removes the second set of eyes that would normally catch a diversion early. Another is a vendor list that has never been cross-checked against employee addresses and bank account numbers, letting a fictitious vendor sit undetected for years. A third is cash-heavy operations, restaurants, retail, service businesses, where daily deposits are estimated rather than counted and reconciled, leaving a gap wide enough to hide consistent skimming. We also frequently find that nobody reviewed payroll change logs, so a former employee kept receiving direct deposits for months after leaving.

We work inside whatever bookkeeping platform the business already uses, most often QuickBooks Online or Xero, pulling the general ledger detail and bank feed history directly rather than working from printed reports. Microsoft Excel is where the trace and the loss schedule live, since every formula and cross-reference needs to be auditable by a second reviewer. For larger transaction populations, CaseWare IDEA lets us run the whole ledger against duplicate-payment and round-dollar tests rather than sampling, which matters when the suspected pattern could be hiding inside thousands of line items. Bank and card statement exports come in whatever format the institution provides, typically PDF or CSV, and we convert those into a structured format before tracing begins.

Embezzlement investigation support is scoped and quoted after a call covering the suspected pattern, the number of accounts and years involved, and the deadline if one exists (an insurance claim window or a statute of limitations, for example). It is billed under our Scale tier as a custom engagement rather than a flat monthly fee, since the hours depend heavily on how many transactions need individual tracing and how complete the underlying records are. A short, well-documented pattern over one or two accounts costs far less than a multi-year, multi-entity trace with missing statements that need to be requested from banks directly.

Every figure on the final loss schedule has to tie back to a specific bank record, invoice, or payroll entry; a number that cannot be traced does not go on the schedule as confirmed loss. A senior reviewer reviews the trace for completeness, the estimation method and the overall presentation before delivery, checking specifically that assumptions are stated rather than buried inside a total. We also stress-test the schedule from the other side: for every flagged item, could a legitimate explanation account for it, and if so, is that explanation documented or just plausible.

Timing decides more outcomes in these matters than the accounting itself does. Once a suspected employee knows they are being investigated, documents can go missing, a resignation letter can arrive within days, and the story that eventually gets told to a mediator or a jury has had time to solidify. We can trace the pattern using bank statements pulled directly from the institution, payroll exports, and read-only access to the accounting file, all without the suspected employee's knowledge, and hand you or your attorney a complete picture before any conversation happens. That sequencing, trace first, confront second, is usually what determines whether a recovery is realistic.