CFAP · Certified Forensic Accounting Professional
How to Write a Forensic Investigation Report
A practical, step-by-step guide to writing a forensic investigation report that will hold up to scrutiny — from establishing predication through evidence handling, loss quantification, and defensible report structure.
What is CFAP?
A short introduction to the Certified Forensic Accounting Professional (CFAP).
See the CFAP course →Establish the Predication and Scope
Before any investigative work begins, document the predication — the specific facts, allegation, or anomaly that justified opening the investigation — and agree the engagement's scope in writing: which entities, time period, and transaction types are in scope, and who has authorized the work. A report that cannot point back to a clear, documented predication is vulnerable to challenge on the basis that the investigation itself was not properly justified.
Gather and Preserve Evidence
Collect financial records, correspondence, and supporting documentation using a defensible chain of custody from the outset — note who provided each document, when, and in what form (original vs. copy). Digital evidence (emails, accounting-system exports, access logs) should be preserved in its native format wherever possible; converting or summarizing it too early can raise authenticity questions later. Never alter a source document — work from copies and keep originals untouched.
Reconstruct the Financial Picture
Rebuild the relevant transactions and account activity independently of the subject's own summaries — trace transactions to source documents (invoices, bank statements, shipping records) rather than relying on management-prepared schedules. Where records are incomplete, document what is missing and how any reconstructed figures were derived, so a reviewer can follow the methodology, not just the conclusion.
Interview Planning and Documentation
Plan interviews in a logical sequence — typically corroborating witnesses before the subject of the investigation — and document each interview contemporaneously: date, time, participants, and a factual summary of what was said, not paraphrased conclusions. Avoid leading questions that could later be characterized as suggesting the answer rather than eliciting it.
Quantify the Loss
State the financial impact using a clearly disclosed methodology (e.g., direct tracing of diverted funds, a but-for comparison against expected results, or a statistical extrapolation from a sample) and be explicit about assumptions, exclusions, and the confidence level of the estimate. An unsupported or unexplained loss figure is one of the most common points of challenge in any proceeding that follows.
Write the Findings in Plain, Defensible Language
State findings as what the evidence shows, not as unsupported conclusions about intent — "the records show X was recorded without supporting documentation" holds up better than "X committed fraud," which is a legal conclusion outside the accountant's role. Distinguish clearly between fact (supported directly by evidence), inference (a reasonable conclusion drawn from facts), and opinion, and cite the specific evidence supporting each finding.
Structure: Executive Summary Through Appendices
A defensible report typically follows a consistent structure: an executive summary of scope and key findings; background and predication; methodology; detailed findings organized by issue or scheme; the loss quantification; conclusions and recommendations; and appendices containing the supporting schedules and source-document references. Consistent structure makes the report easier for a non-accountant reader (counsel, a board, a regulator) to follow and easier for another professional to review or challenge on the merits.
Common Mistakes That Weaken a Report
The recurring failures: overstating certainty ("proves" instead of "is consistent with"), omitting how a figure was calculated, failing to address an obvious alternative explanation the subject is likely to raise, inconsistent terminology for the same scheme across sections, and a loss calculation that isn't traceable back to the underlying schedules in the appendix.
Frequently Asked Questions
- Who is the audience for a forensic investigation report?
- Typically legal counsel, a company's audit committee or board, a regulator, or a court — readers who need the findings to be clear, well-supported, and understandable without requiring the reader to already be an accountant.
- What's the difference between a forensic investigation report and a standard audit report?
- A standard financial-statement audit is designed to give reasonable, not absolute, assurance that the statements are free of material misstatement as a whole, and is not primarily an investigation into a specific suspected fraud. A forensic investigation report responds to a specific predication, traces transactions in depth, and is written with the expectation it may be scrutinized in a legal or disciplinary proceeding.
- Should a forensic accountant state an opinion on whether fraud occurred?
- The report should state what the evidence shows and let findings speak for themselves as clearly as possible; a definitive legal conclusion that a crime occurred is generally outside the forensic accountant's role and is left to the trier of fact, though the report can and should state that findings are "consistent with" a particular scheme when the evidence supports that.
This reference is part of Riskpro's Certified Forensic Accounting Professional (CFAP) programme.
See the CFAP course →