Forensic accounting
Transaction tracing and funds-flow analysis
Transaction tracing and funds-flow analysis from Finbryn follows money across every account it touched, bank to bank and entity to entity, so a transfer that looked ordinary on one statement gets laid out step by step for counsel, an investigator or an insurer. A senior reviewer checks every figure against the source document first.
Management report
Illustrative client ยท August 2026
USD
| Line | Aug | Jul | |
|---|---|---|---|
| Revenue | 142,380 | 131,904 | +10,476 |
| Cost of sales | (51,260) | (48,115) | (3,145) |
| Gross profit | 91,120 | 83,789 | +7,331 |
| Payroll | (46,300) | (45,900) | (400) |
| SoftwareNoted | (6,480) | (5,490) | (990) |
| Rent | (8,000) | (8,000) | 0 |
| Other operating | (9,215) | (9,870) | +655 |
| Net income | 21,125 | 14,529 | +6,596 |
Reviewer's note
Software is up on last month after two seats were added mid-month. Revenue includes one milestone invoice that will not repeat next month.
Illustrative. An example of the document, not a client's figures.
A single bank statement almost never tells the real story. A large outgoing wire looks unremarkable sitting between a payroll run and a vendor payment, until you place it next to the transfer that arrived in the same account three days earlier and the transfer that left the receiving account four days after that. Funds-flow tracing exists to put that whole chain in one place, because a chain scattered across four different banks' PDF statements is functionally invisible to anyone reading one statement at a time.
We build this work for the people who actually have to act on it: an attorney preparing for a deposition, a forensic investigator scoping an embezzlement claim, an insurer's adjuster reviewing a fidelity bond loss, or a business owner who suspects money is leaving the company through a channel nobody has mapped. The output is not a narrative opinion about what happened. It is a schedule, a source list, and a documented account of where the trail runs cold.
Most engagements start narrow. Counsel hands us a specific set of transactions, dates, or account numbers tied to the matter, and we trace forward and backward from there. Some engagements start wide, particularly in a suspected embezzlement or a shareholder dispute where nobody yet knows the full scope of what moved. In either case the method is the same: every transfer gets a date, an amount, a source account, a destination account, and a note on where that figure came from.
The deliverable is built to survive a challenge. Opposing counsel, a skeptical adjuster, or a judge will ask where a number came from, and the answer needs to be a page number on a specific bank statement, not our own summary. That is the standard we hold every traced figure to before it leaves our hands, and a senior reviewer reviews the full schedule against source documents before delivery.
What is included
A funds-flow engagement covers the full chain of custody for money, not a single hop. We trace a transfer from its origin account through every intermediate stop, whether that is another business account, a personal account within scope, a vendor, or an asset purchase that converts cash into something else entirely. Where the scope includes both business and personal accounts, we trace across that boundary rather than stopping at the business's own books.
We include a funds-flow schedule or diagram laid out chronologically, a source list mapping every dollar figure back to the bank, card, or processor statement it came from, and a written note on any point where a missing statement or an unreadable image breaks the chain. We also flag round-trip transfers, where money moves through two or three accounts and returns close to its starting point, and layering, where several small transfers converge into one larger account before moving again.
How the process works
We begin with an intake call to establish the boundary of the matter: which accounts, which entities, which date range, and whether counsel wants the trace to start from specific transactions or run against a full account population. From there we collect statements, either directly from the client, through counsel's document production, or from bank records already gathered in the matter.
Each statement gets logged into a working file before any tracing starts, so we know exactly what we have and what is missing before we build the schedule. Tracing itself is manual line-item work supported by spreadsheet formulas and, for larger transaction populations, CaseWare IDEA to flag matching amounts and dates across accounts faster than a human eye alone. Every match gets a human review before it goes into the schedule; software finds candidates, it does not decide what counts.
The finished schedule and source list go through a senior reviewer's review before delivery. Where the matter is active litigation, we sequence delivery against filing deadlines counsel gives us at intake.
Who this is for
This work is engaged most often by attorneys building or defending a fraud, embezzlement, or breach-of-fiduciary-duty claim, by insurers reviewing a fidelity bond or crime-policy claim, and by business owners or boards who suspect a diversion of funds but do not yet have the trail laid out. It also shows up inside a partner or shareholder dispute, where one side wants to see exactly where distributions, loans, or draws actually went, and inside a divorce or family-law matter where business and personal accounts have been commingled.
It is not the right service if what you need is a routine monthly reconciliation or a bookkeeping catch-up with no dispute or investigation attached; our regular bookkeeping tiers cover that at a lower cost and a different cadence. It is also not a substitute for a criminal investigation with subpoena power. We trace what the available records show; we cannot compel a bank or a third party to produce a statement nobody has yet obtained.
Common problems we fix
The most common problem is a client who is certain money moved somewhere but has only ever seen it from one account's point of view, so the trail dead-ends at the first hop. We fix that by pulling the receiving account's own statements and continuing the trace from there, rather than stopping where the client's own visibility stops.
A close second is round-dollar or evenly-spaced transfers that look coordinated but turn out, once traced, to be legitimate recurring payments like rent or a loan amortization schedule. We trace those the same as any other transfer and let the schedule show what they actually were, rather than assuming a pattern means something it does not.
A third recurring problem is gaps: a statement that was never saved, an account at a bank that has since closed, or a period covered by an app-based account with no PDF export. We do not paper over a gap with an estimate; we log it in the source list and state exactly where the chain breaks, because a fabricated bridge is worse than an honest gap when the schedule is later tested under cross-examination.
Software and integrations
Tracing itself runs primarily in Microsoft Excel, where we build the funds-flow schedule with formulas that tie every cell back to a cited source rather than a typed-in number. For a larger transaction population, CaseWare IDEA lets us run matching and duplicate-detection passes across tens of thousands of rows in a fraction of the time manual review would take, though every flagged match still gets a human check before it enters the schedule.
Where the underlying accounting file is in QuickBooks Online or Xero, we export transaction-level detail directly rather than working from screenshots or PDF reports, which keeps every figure traceable back to its original entry. Bank and card statements typically arrive as PDFs from the institution itself, which we convert to structured data before tracing begins so the schedule can be built and checked efficiently.
What it costs
Funds-flow tracing is quoted per engagement, not sold as a flat monthly package, because the time required depends heavily on the number of accounts, the length of the period at issue, and how many statements survive versus need to be requested. A narrow trace covering two accounts over three months looks very different in scope from tracing twelve accounts across four entities over two years.
We give a written estimate after a scoping call where you describe the matter, the accounts involved, and any deadline counsel has set. If new accounts or a longer period surface once tracing is underway, which happens often in this type of work, we flag the scope change and requote before continuing rather than letting the bill grow silently.
How we measure quality
Every figure on the funds-flow schedule ties to a page number on a specific source statement, and that source list is delivered alongside the schedule, not held back. Before delivery, a senior reviewer checks the schedule line by line against the underlying statements, and reviews the finished package for internal consistency and for anywhere the presentation could be misread as an opinion about intent rather than a factual trace.
We measure our own work the way a skeptical reader will: could someone unfamiliar with the matter pick up the source list and verify any single figure in under a minute. If the answer is no for even one line, the schedule goes back for revision before it goes out the door.
How we work
The process
- 1
Scoping call
We establish which accounts, entities, and date range are in scope, and whether counsel wants tracing to start from specific transactions or a full account population.
- 2
Statement collection
Bank, card, and processor statements are gathered from the client, counsel's document production, or records already collected in the matter, then logged before tracing begins.
- 3
Line-item tracing
Each transfer is followed to its next stop, whether another account, a vendor, a person, or an asset purchase, with the date, amount, and account logged for every hop.
- 4
Pattern flagging
Round-trip transfers and layering patterns are identified and shown with the underlying transfers behind them, described as patterns, not as conclusions about intent.
- 5
Gap documentation
Any point where a missing or unreadable statement breaks the chain is noted directly in the source list rather than bridged with an estimate.
- 6
Dual review
A senior reviewer checks the schedule against source statements line by line, then reviews the finished package before delivery.
- 7
Delivery and revision
The schedule, diagram, and source list are delivered on the timeline counsel set, with revisions turned around against the case schedule as the matter develops.
Transaction tracing and funds-flow analysis
Common problems we fix
The problem
How we fix it
- The trail dead-ends at the first account the client can seeWe pull the receiving account's own statements and continue tracing from that side, rather than stopping where the client's visibility stops.
- Round-dollar transfers look suspicious but are actually routineWe trace the transfer to its actual purpose, such as a rent payment or loan amortization, and let the schedule show what it was rather than assuming a pattern.
- A statement from a closed account or old app cannot be locatedWe request what can still be obtained from the institution and log the exact gap in the source list rather than estimating a bridge across it.
- Personal and business accounts are commingled with no clear boundaryWe trace across both where the engagement scope allows it, and we ask counsel to confirm the boundary in writing before work starts.
- Thousands of transactions make manual tracing impractical on a deadlineWe run CaseWare IDEA matching passes to surface candidate links quickly, then review every flagged match by hand before it enters the schedule.
By the numbers
2,402
Source: acfe.com/report-to-the-nations, September 2026
$532,000
Source: acfe.com/report-to-the-nations, September 2026
Pricing
Funds-flow tracing is scoped and quoted per engagement rather than sold as one of our standard monthly bookkeeping tiers, since the work depends on account count, period length, and how many statements survive. See the published rate card at /us/pricing for how our standard bookkeeping tiers are structured; a forensic engagement like this one is quoted separately after a scoping call.
Transaction tracing and funds-flow analysis
Glossary
- Funds-flow schedule
- A chronological table showing the source account, destination account, amount, and date for every traced transfer in a matter.
- Layering
- A pattern where several smaller transfers converge into a single account before moving on, often used to obscure the original source of funds.
- Round-tripping
- Money that moves through two or more accounts and returns close to its starting point, sometimes used to disguise the number of hops involved.
- Source list
- A document mapping every figure in a schedule back to the exact bank, card, or processor statement it was taken from.
- Chain of custody
- The documented, unbroken path of a record from its original source to its use in a schedule or exhibit, preserved so its reliability can be checked.
Questions
Frequently asked questions: Transaction tracing and funds-flow analysis
Do you trace money across personal and business accounts?
Yes, where the scope covers both. We trace whatever accounts are within the boundary counsel or the client sets, and we ask for that boundary in writing before tracing starts so everyone agrees on what is and is not in scope.
What if some statements are missing?
We trace what the available statements show and note every gap where a missing statement breaks the chain, rather than filling the gap with an estimate presented as fact. The source list states exactly where the trail runs cold.
Do you trace cryptocurrency transfers as well as bank transfers?
We can trace exchange and wallet activity where records and statements are available, alongside the traditional banking side of a matter, and we note upfront where a wallet's on-chain history needs a specialist blockchain-analytics tool we do not run in-house.
How far back can you trace transfers?
As far back as statements exist. Banks generally keep online statement history for a limited number of years, so for older periods we help identify what to request directly from the institution before assuming the record is gone.
Who typically requests funds-flow tracing?
Attorneys in a fraud or dispute matter, insurers reviewing a fidelity bond or crime-policy claim, and boards or owners looking into a suspected diversion of funds most commonly request this work, usually after a scoping call with counsel involved.
Can this work be used to support a court filing?
The schedule and source list are built to be traceable and well documented, which is what a filing typically requires. Whether a specific exhibit is admissible, and any testimony about it, is a matter for counsel and, where testimony is needed, a credentialed expert-witness partner.
Does the schedule tell us who is responsible for a transfer?
No. The schedule shows where money moved and when. Attributing responsibility to a specific person is a legal conclusion outside our scope, and we leave that determination to counsel, an investigator, or a court.
How quickly can a funds-flow trace be turned around?
It depends on how many accounts and statements are involved and whether records still need to be requested from a bank. Tell us the filing or claim deadline at intake and we sequence the work against it, flagging early if the timeline looks unrealistic.
Related services
- Forensic accountingFinancial records reconstructionRebuilding a complete financial record from bank statements, invoices and whatever source documents survive, for a dispute, investigation or claim where the existing books cannot be relied on as they stand.
- Forensic accountingFraud-indicator reviewScreening a set of books for the patterns that tend to accompany fraud: Benford's Law deviations, duplicate payments, round-dollar entries and vendors that do not hold up to a closer look.
- Forensic accountingEmbezzlement investigation supportBookkeeping-level support for an internal or external embezzlement investigation: tracing suspected diversions, quantifying the loss period by period, and preparing the schedules an investigator or insurer will ask for.
- Forensic accountingForensic data extraction from accounting systemsPulling a complete transaction history out of QuickBooks, Xero, NetSuite or another system, with the audit trail preserved, so the data behind a review or investigation is not altered on the way out.
Industries
- Law firms and trust accountingBookkeeping for law firms that must keep client trust funds separate from operating funds and reconciled every month.
- Real estate and property managementBookkeeping for property owners and managers tracking income, expenses and reserves at the level of each individual property.
- Professional servicesBookkeeping for professional service firms such as engineering, architecture and IT consulting billing clients by project or retainer.
Related guides
- TaxIRS Notices Explained: CP2000, CP14, CP504, LT11 and MoreA plain-language guide to common IRS notices, what each one means, the real response deadline, and when to bring in an enrolled agent or CPA.
- BookkeepingHow to Design a Chart of Accounts (With SaaS and Ecommerce Examples)How to number and structure a chart of accounts, with worked SaaS and ecommerce examples and the mistakes that force a costly rebuild later.
Sources
- [1]ACFE Report to the Nations, September 2026
- [2]IRS: How long should I keep records, September 2026
- [3]IRS: Instructions for Forms 1099-MISC and 1099-NEC, September 2026
- [4]CaseWare IDEA data analysis software, September 2026
Next step
Talk to the team that would run your books
A short call covers your setup, your software and what a first month would look like. You get a written scope and price after it.
Need this in writing? Download a one to two page scope sheet for Transaction tracing and funds-flow analysis: what is included, the process, and where pricing lives.
Download the scope sheet