Forensic accounting is accounting done in the expectation that someone will argue about it. That single constraint changes everything: how evidence is gathered, how conclusions are expressed, and how much of the work goes into documenting a process that ordinary accounting would simply perform. The output is not a set of accounts — it is an opinion that has to survive cross-examination.
The three kinds of work
Investigations establish what happened. Suspected fraud, misappropriation, an unexplained shortfall, a whistleblower allegation. The work is evidence-led and its early decisions — securing records before they can be altered, preserving devices properly — determine whether anything found later is usable.
Quantum and dispute work establishes what a loss is worth. Breach of contract, professional negligence, business interruption, shareholder disputes, matrimonial proceedings. The accounting question is usually narrow; the difficulty is the counterfactual — what would have happened but for the event — and that is where opposing experts disagree.
Regulatory and compliance work sits between the two: reviews commissioned because a regulator has raised a concern, anti-money-laundering investigations, and the independent examinations that follow a control failure.
Evidence discipline is the whole product
The difference between forensic work and ordinary analysis is procedural rigour, and it starts immediately.
Preservation. Records and devices must be secured before anyone is alerted. An investigation that begins by asking the suspected individual for their laptop generally ends there. Digital evidence needs forensic imaging by someone qualified to do it, because opening files on the original device changes metadata that may matter.
Chain of custody. Every item of evidence needs a documented trail: who took it, when, where it has been held. Evidence with a gap in that trail can be excluded regardless of what it shows.
Working papers. Every figure must be traceable to a source, every assumption stated, every instruction from the client recorded. An expert who cannot explain where a number came from has no opinion, only an assertion.
Data analytics has become central to the investigative side — testing whole populations rather than samples, matching supplier bank details against payroll, looking for payments just below approval thresholds, journals posted outside working hours, and duplicate or sequential invoice patterns. The analysis finds the anomalies; the judgement is in deciding which of them mean anything.
Acting as an expert witness
Where the work is destined for court, the expert's duty is to the court and overrides any obligation to the party paying the fee. That is not a formality — it governs how the report is written and it is the first thing tested in cross-examination.
The consequences in practice: the report must state the facts and assumptions relied on, identify material outside the expert's expertise, give reasons for each opinion, and — crucially — set out the range where opinions could reasonably differ, along with the points on which the expert has changed their view. An expert who advocates for their client's number rather than explaining the range is easier to discredit than the number itself.
Experts on both sides are typically required to meet and produce a joint statement of what is agreed and what is not, which frequently narrows a dispute more than any other step in the litigation.
Where losses are actually quantified
Quantum work concentrates on a small number of recurring questions: whether the lost profits claimed would genuinely have been earned; whether costs claimed are incremental or would have been incurred anyway; the period over which the loss runs; the discount rate applied to future losses; and mitigation — what the claimant did, or should have done, to reduce the damage.
The commonest weakness in claims prepared without forensic input is the counterfactual: a projection of continued growth in a business that was already declining, or a margin assumption that the historic accounts do not support. The opposing expert will find it, and the credibility damage extends to the parts of the claim that were sound.
Before you need one
Most organisations meet forensic accountants after something has gone wrong, and by then the options are narrower. Two preparations pay for themselves. First, an incident response plan that says who is called, in what order, when fraud is suspected — including the instruction not to confront the individual before evidence is secured. Second, controls testing that would find the problem internally: reconciliations reviewed, supplier onboarding separated from payment approval, and periodic analytics over the payment population, as set out in our guides to the purchase ledger and control testing.
The other preparation is insurance. Crime and fidelity policies have notification requirements and time limits, and a claim notified late is frequently a claim declined.
Acumon delivers investigations, quantum and expert work through forensic accounting and forensic audit services, with anti-fraud reviews for organisations that would rather find the problem before it becomes a case. If fraud is suspected today, the first call should be about preserving evidence, not about quantifying it.