What a fraud investigation sets out to prove

What a forensic investigation into suspected fraud must establish, how to scope it with the client and how to present findings that stand up.

By Achekam · 11 October 2026 · 4 min read · For Accountants & audit firms in South Africa, Nigeria, Kenya

The call usually comes in a hurry. A business owner has noticed money missing, or a board has received an anonymous tip, and they want the firm to "look into it". What they rarely say is what, exactly, they want to know, and what they intend to do with the answer.

Without that clarity, an investigation drifts. Work is done on questions nobody asked, the questions that matter are answered only partly, and the report arrives in a form that is useless for a disciplinary hearing, an insurance claim or a criminal case. The first job is to be precise about what the investigation is meant to establish.

The four things an investigation must answer

ACCA's technical article on forensic accounting sets out the purpose of an investigation into an alleged fraud:

1. Discover whether a fraud actually took place. Suspicion is not proof. Missing stock may be theft, or it may be poor record-keeping.
2. Identify those involved. Including people who helped, knowingly or not, and people who should have noticed.
3. Quantify the financial loss suffered by the client. With a method that can be explained and repeated.
4. Present findings to the client and potentially to court. In a form that the intended audience can use.

ACCA describes forensic accounting as the whole investigative process, including potentially acting as an expert witness if a fraud comes to trial. So the fourth objective shapes the first three: evidence gathered without thinking about how it will be presented may not be usable when it matters.

Scoping the questions before work starts

ACCA groups the frauds a forensic accountant may investigate into three categories: corruption, asset misappropriation and financial statement fraud. Knowing which category the allegation falls into helps frame the questions, the evidence needed and the people to speak to.

A scoping conversation with the client should settle:

• The allegation, in specific terms: what is suspected, over what period, involving which processes.
• The purpose: disciplinary action, recovery from the person, an insurance claim, a report to the authorities, or simply understanding what went wrong.
• The audience for the report, and whether lawyers are involved from the start.
• Access: which records, systems and people the firm can reach, and who will authorise it.
• Confidentiality: who at the client knows, and who must not.
• What is out of scope, stated in writing.

Write the questions into the engagement letter. If the scope changes as evidence emerges, record the change and the client's agreement.

Why an investigation is not an audit

Clients often assume that an investigation is a more thorough audit. It is not, and the distinction should be explained early.

ICAEW explains that ISA 200 sets the auditor's overall objectives as obtaining reasonable assurance about whether the financial statements as a whole are free from material misstatement, whether due to fraud or error, and reporting on the statements in line with the auditor's findings. An audit opinion is about the statements as a whole.

An investigation is about specific events and people. It does not give an opinion on the statements, and its conclusions are only as wide as its scope. A finding that a particular payments scheme cost the client a certain amount says nothing about whether other schemes exist. The report should say that plainly.

Setting up the engagement in Achekam

Achekam lets staff choose an engagement's type when creating it, from built-in types such as statutory audit or independent review, and a firm can add its own named types. A firm that does forensic work can create a type for it, so investigations are recorded and reported separately from audits and reviews.

Achekam also ships working-paper template packs written in its own words, including one for forensic work, for a firm to adopt and approve. The catalogue is marked unapproved platform content until the firm adopts it, so confirm it is in your workspace and approve it before relying on it for an engagement.

Investigations need tight access. Partners and administrators can restrict a client or a single engagement to named people, with a reason. A restriction is lifted rather than deleted, with who did what and when recorded. The account manager and the engagement's partner and manager can always open it. For a fraud investigation, that means staff who know the suspect, or who work on the client's other engagements, need not see the file. Restricting client access explains how the restriction works.

Presenting the findings

Whether the audience is the client's board or a court, a report that holds up tends to share these features:

Avoid conclusions about guilt. The investigator reports what the evidence shows; whether someone is guilty of an offence is for a court.

Disputes that are not fraud

ACCA notes that forensic accountants may also be asked to look into non-fraud matters, such as monetary disputes. Partnership break-ups, contract claims, shareholder disagreements and lost-profit calculations use the same skills: careful evidence, clear quantification and a report written for someone who must decide.

For how forensic engagements sit beside a firm's other assurance work, see internal audit and forensic assignments. The next time a client calls about missing money, start by agreeing the four questions in writing.

General guidance only, not advice on your own circumstances. Tax and payroll rules change: check the current position with the authority or your adviser.