Forensic Accounting Investigation Services

A forensic accounting investigation establishes what happened, when, and how much is at stake. Whether the concern is employee fraud, director misappropriation, inflated expense claims or unexplained cash movements, the findings must withstand legal scrutiny. Our specialist forensic accountancy team works to standards that allow reports to be used in civil proceedings, criminal prosecutions, regulatory complaints and internal disciplinary processes. We also support corporate investigation work where organisations need to uncover financial wrongdoing, quantify loss of profits, or trace misappropriation of assets across connected entities.

When a Forensic Investigation is Needed

Solicitors instruct us when something does not add up. The triggers vary but follow recognisable patterns: an employee with signing authority whose lifestyle has outgrown their salary, a director whose personal expenditure appears to be running through the company, expense claims that cluster around approval thresholds, related-party transactions at prices that make no commercial sense, or pre-acquisition due diligence that has uncovered anomalies the vendor cannot explain. Fraud investigations can also arise from insurance claims disputes, shareholder disagreements, or a breach of fiduciary duty within corporate governance structures.

There is a useful distinction between a forensic investigation and a forensic audit. An investigation is directed at specific allegations or concerns: did this person take this money, and if so, how much and over what period? A forensic audit is broader, confirming whether financial statements accurately reflect what should have happened across an entire system or period. Both produce evidence, but the scope, cost and timescale differ significantly. The investigative approach also differs from a standard valuation exercise, which focuses on what something is worth rather than whether fraudulent activity has occurred.

Early instruction matters. Financial evidence deteriorates over time. Accounting records are overwritten, bank statements become harder to obtain, and individuals who might cooperate today may not cooperate after they have taken legal advice. Where financial fraud is suspected, preserving evidence available before the subject becomes aware is critical. Any discrepancy in the records may indicate a wider pattern of wrongdoing - and every day of delay risks the loss of electronic data that could prove it.

Our Investigation Process

We structure every investigation in four phases, each with a defined scope and deliverable:

Phase 1: Scoping. We review the allegations, identify the relevant period, establish the terms of reference, and assess what records are available. This phase is typically capped-fee (usually 3 to 5 days of work) and produces a scoping report that sets out the investigation plan, estimated costs for each subsequent phase, and any immediate evidence preservation steps required. The scoping report allows the solicitor and client to make an informed decision about whether to proceed.

Phase 2: Data gathering. We collect and secure the relevant evidence: bank statements, accounting records, emails, contracts, invoices, payroll data and any digital records from accounting software. Where records are held by third parties, we work with the solicitor to obtain them through disclosure requests or court orders.

Phase 3: Analysis. This is the core of the investigation. We reconstruct transactions, reconcile accounts, build timelines, apply analytical techniques (discussed below) and quantify the financial impact. Every step is documented so the methodology can be tested if the findings are challenged.

Phase 4: Reporting. The investigation report presents findings in a format appropriate for its intended use. A report for civil proceedings complies with CPR Part 35. A report for a criminal investigation follows CPS guidance on expert evidence. A report for internal disciplinary purposes focuses on the facts and the financial quantification without expressing legal conclusions that are for the tribunal to reach.

Fraud Detection and Investigative Techniques

Our analytical toolkit draws on established forensic accounting methodologies and forensic data analytics, applied to the specific facts of each case. Our investigative skills combine traditional accounting and investigation work with modern data analytics to uncover anomalies that manual review would miss.

Bank statement reconstruction: Where accounting records are incomplete, missing or suspected of manipulation, we rebuild the transaction history directly from bank statements. This involves obtaining statements for all known accounts, matching transactions across accounts, identifying transfers between connected entities, and flagging unexplained credits or debits. The reconstructed record often reveals accounts that were not disclosed and payments that have no supporting documentation.

Benford's Law analysis: Naturally occurring financial data follows a predictable distribution of leading digits. Approximately 30% of first digits should be 1, approximately 18% should be 2, and the frequency declines predictably through to 9 (at approximately 5%). Fabricated figures tend not to follow this distribution because people unconsciously favour certain digits when inventing numbers. We apply Benford's analysis to expense claims, supplier invoices, journal entries and cash receipts. Anomalies do not prove fraud, but they direct the investigation to the transactions most likely to repay detailed scrutiny.

Worked example: An analysis of 4,200 purchase invoices from a construction company revealed that invoices starting with the digit 6 appeared at 14.7% frequency against an expected Benford's frequency of 6.7%. Further investigation showed that 312 of these invoices, all starting with £6,000 to £6,999, were from a single supplier that shared a registered address with the company's procurement manager. The total overpayment was £847,000 over 28 months.

Lifestyle analysis: Comparing declared income against demonstrable expenditure. Where mortgage payments, school fees, vehicle finance, holidays and general living costs consistently exceed declared income, the gap must come from undisclosed sources. This technique is particularly effective in matrimonial cases (see our matrimonial finance page) and in cases involving cash-intensive businesses.

Net worth method: Comparing opening and closing net worth, adding known expenditure, and subtracting known income. The residual represents either undisclosed income or unexplained asset growth. HMRC uses this method in tax fraud investigations; it is equally effective in civil dispute cases and professional negligence claims.

Journal entry testing: Manual journal entries are the most common vehicle for accounting fraud. We focus on entries posted outside normal working hours, entries at round amounts, entries made close to financial reporting dates, and entries that lack supporting documentation or proper authorisation. Any anomaly in the pattern of journal entries can flag potential financial irregularities that warrant a deeper enquiry.

Asset Tracing and Recovery

Identifying that money has been taken is only half the problem. The other half is finding where it went. Asset tracing involves following funds through multiple accounts, shell companies and, in some cases, multiple jurisdictions.

We work with solicitors to support applications for freezing injunctions under CPR Part 25. A worldwide freezing order (the remedy formerly known as a Mareva injunction) prevents the respondent from dissipating assets pending trial. The application requires evidence of a good arguable case and a real risk of dissipation. The forensic accountant's role is to provide the financial evidence supporting the application: the quantum of the claim, the trail of funds, and the evidence of dissipation risk.

Practical asset tracing involves:

• HM Land Registry searches to identify property holdings
• Companies House filings to map directorships, shareholdings, PSC entries and charges across connected entities
• Analysis of bank statements to trace funds between accounts and identify recipients
• Cross-referencing known assets against declared income to identify unexplained wealth

We trace and quantify. Solicitors enforce. The distinction matters: the forensic accountant provides the evidence base; the legal team obtains the orders and executes the recovery strategy. In insolvency cases, we work alongside legal teams and insolvency practitioners to identify transactions at an undervalue, preferences, and other conduct that may give rise to claims against former directors.

Criminal Defence and Prosecution Support

Forensic accountants act on both sides of criminal proceedings. Our multi-disciplinary team provides expert analysis of financial evidence in fraud trials under the Fraud Act 2006, money laundering charges under the Proceeds of Crime Act 2002, and complex financial investigations managed by the Serious Fraud Office under s2 Criminal Justice Act 1987.

In confiscation proceedings under POCA 2002, the prosecution must establish the "benefit" from criminal conduct. Where the defendant is found to have a "criminal lifestyle" (as defined in s75 POCA), the statutory assumptions apply: all property transferred to the defendant in the six years before proceedings, and all property held by the defendant, is assumed to be the proceeds of crime. The burden shifts to the defendant to prove otherwise. The forensic accountant's role, whether acting for prosecution or defence, is to analyse the financial evidence and present a clear quantification of benefit and available amount.

R v May [2008] UKHL 28 clarified the definition of benefit in confiscation proceedings. R v Waya [2012] UKSC 51 established that confiscation orders must be proportionate and should not require a defendant to pay more than the benefit actually obtained. Both cases are relevant to the forensic accountant's quantification of the available amount.

SFO investigations under s2 CJA 1987 involve compulsory powers. Individuals served with a s2 notice must produce documents and answer questions. Refusal is a criminal offence. The forensic accountant may be instructed by the SFO to analyse seized financial records, or by the defence to review the prosecution's analysis and identify weaknesses.

Regulatory Investigations

Financial analysis is frequently needed in regulatory and legal proceedings. FCA investigations into market abuse, insider dealing or misleading financial statements require detailed transaction analysis. SRA investigations into solicitors' handling of client money need forensic reconstruction of client account movements. HMRC enquiries into economic crime and tax fraud require analysis of income, expenditure and asset movements. These regulatory bodies have wide-ranging powers, and an impartial, objective assessment of the financial data is critical to meeting their legal standards.

We also conduct internal corporate investigations for organisations that need to understand their exposure before regulators become involved. An early enquiry allows the company to self-report with a clear picture of what happened, take remedial action, and demonstrate cooperation - all of which can significantly affect the regulatory outcome and limit reputational damage. Stakeholders - including boards, investors and insurers - typically want an independent review that addresses both the immediate financial impact and any underlying breach of corporate governance or internal controls. Where the findings may lead to legal proceedings, we can act as a witness in court - giving evidence as an expert witness and testifying to our methodology and conclusions within the framework set by CPR Part 35.

Instructing Us for an Investigation

Privilege is a critical consideration at the outset. Where the solicitor commissions a report as part of our forensic accounting investigation services, legal advice privilege protects the report and the underlying working papers. Where litigation is contemplated, litigation privilege may also apply. The way the instruction is structured determines whether privilege attaches, and we work with the instructing solicitor to ensure the engagement is properly framed. Our objectivity as an independent forensic accounting service provider is maintained regardless of which party instructs us.

Before contacting us, solicitors should take steps to preserve evidence: secure access to accounting systems, retain copies of emails, and prevent the subject of the investigation from altering or deleting records. If the concern is urgent, we can advise on evidence preservation during an initial scoping call.

We offer a free 30-minute initial scoping call to discuss the nature of the concern, the records available, and the likely scope and cost of an investigation. Phase 1 scoping is a capped-fee engagement, typically £2,500 to £5,000, producing a clear investigation plan that allows the solicitor and client to decide whether to proceed.

For expert witness appointments arising from investigation findings, or for litigation support in quantifying losses, we can advise on the appropriate engagement structure from the outset. To discuss a potential investigation, contact Jack Ross at our Manchester office or call 0161 832 4451. For tax implications arising from fraud or misappropriation, mtd.digital provides guidance on HMRC investigation procedures and Making Tax Digital compliance.