The CFE-CPA-Attorney Combination in Forensic Work
Most forensic accounting engagements involve one of two professionals: a CPA who understands the financial records but cannot advise on legal strategy or draft legal documents, or an attorney who understands the legal framework but must rely on a separate financial expert to analyze the numbers. At Montgomery Legal, the Certified Fraud Examiner, CPA, and attorney credentials are held by the same person which means the investigation strategy, the financial analysis, and the legal response are developed together from the start.
That integration matters in ways that become visible quickly. The CFE credential means the investigation is conducted using established fraud examination methodology the documentary evidence is gathered in a way that preserves its evidentiary value, the financial analysis is structured around the legal theories that will eventually matter, and the findings are documented in a format that can support civil litigation, criminal referral, or internal resolution depending on what the facts warrant. The attorney credential means the engagement can be structured under attorney-client privilege from the outset protecting the investigation from compelled disclosure if the matter becomes adversarial.
We conduct forensic investigations for business owners who suspect an employee, vendor, or partner is stealing; for attorneys who need a financial expert for litigation; for boards and audit committees that need an independent review; and for individuals navigating divorce, partnership dissolution, or business disputes where financial misconduct is suspected. Every engagement begins with a confidential consultation.
Structuring the engagement under privilege: When a forensic investigation has litigation potential or when the subject of the investigation is likely to become adversarial engaging forensic counsel through an attorney creates a work product protection layer that engaging a standalone accountant does not. Communications, working papers, and findings developed under the direction of legal counsel for purposes of litigation are shielded from discovery in ways that purely accounting work is not. We advise on how to structure the engagement at the outset based on the likely trajectory of the matter.
What we investigate and the services we provide
Employee Embezzlement and Theft
Investigation of suspected employee theft, embezzlement, check tampering, payroll fraud, and misappropriation of company assets including quantification of losses, identification of the scheme, and documentation for civil or criminal action.
Financial Statement Fraud and Manipulation
Analysis of financial statements for manipulation, misrepresentation, or fabrication including revenue recognition fraud, expense understatement, fictitious entries, and concealment of liabilities.
Vendor and Procurement Fraud
Investigation of fictitious vendors, overbilling schemes, bid rigging, kickbacks, and conflicts of interest between employees and suppliers where company funds are diverted through the vendor payment process.
Partner and Ownership Disputes
Financial analysis in business disputes where a co-owner is suspected of unauthorized distributions, self-dealing, undisclosed compensation, or diversion of business opportunities including tracing of funds and reconstruction of ownership accounts.
Lost Profits and Damages Calculations
Calculation of economic damages in litigation lost profits, unjust enrichment, disgorgement, and diminution of business value with expert reports and testimony support for civil proceedings.
Asset Tracing and Fund Tracing
Following money through bank accounts, entities, and transactions to establish where funds originated, where they went, and who controlled them used in fraud cases, divorce proceedings, and complex litigation.
Business Valuation for Disputes
Independent business valuations for litigation, divorce, partnership dissolution, shareholder disputes, and estate matters providing a credible, documented opinion of value that can be presented in court.
Internal Controls Review and Fraud Risk Assessment
Evaluation of existing internal controls for gaps that create fraud opportunity with recommendations for control improvements that reduce risk without imposing unnecessary operational burden.
Common Fraud Schemes and How They Work
Fraud follows patterns. The Association of Certified Fraud Examiners' global research consistently finds that the same categories of schemes account for the vast majority of occupational fraud losses and that the typical fraud runs for 12 to 18 months before it is detected. Understanding how each scheme operates helps identify the right evidence to look for and the right questions to ask.
Asset misappropriation is the most prevalent category of occupational fraud accounting for approximately 86% of all cases in ACFE research. It involves employees stealing or misusing company resources, and it takes many forms depending on the employee's position and access to the company's financial systems.
Cash skimming occurs before a transaction is recorded a cash sale is pocketed before it enters the books, leaving no direct paper trail. Cash larceny occurs after recording the money appears in the records but is then diverted. Check tampering involves altering, forging, or intercepting company checks. Payroll fraud involves ghost employees, falsified time records, or unauthorized raises. Expense reimbursement fraud involves submission of fictitious or inflated expense reports.
The investigation follows the money: bank records are reconciled to accounting records, payroll files are compared to HR records and timekeeping systems, and expense reports are cross-referenced against receipts and business purpose. Anomalies in frequency, amount, or recipient pattern are the starting point not the conclusion.
- Bank statements reconciled to the general ledger
- Cancelled checks and bank images for alterations
- Payroll registers vs. HR employee files
- Credit card statements and expense reports with receipts
- Cash register records vs. daily deposit slips
- Accounts payable aging and vendor master file
- Journal entry logs especially late-stage and manual entries
Financial statement fraud involves intentional misrepresentation in the financial statements overstating revenues, understating expenses, concealing liabilities, or inflating asset values to present a picture of the business that does not reflect reality. It is less common than asset misappropriation but produces significantly larger losses, and it is most likely to appear in contexts where financial statement results drive compensation, financing decisions, or purchase prices.
Revenue fraud takes many forms: recording fictitious sales, prematurely recognizing revenue that has not been earned, and channel stuffing shipping product to distributors with side agreements allowing returns. Expense fraud involves capitalizing costs that should be expensed, understating accrued liabilities, and hiding losses in asset accounts. In a business sale context, financial statement manipulation inflates the purchase price and exposes the seller to fraud claims after closing.
- Revenue growth inconsistent with industry or operating metrics
- Accounts receivable aging that does not match reported revenue
- Gross margin improvements that lack operational explanation
- Year-end journal entries with minimal documentation
- Unusual related-party transactions near period end
- Discrepancies between financial statements and tax returns
Vendor fraud occurs when company funds are diverted through the accounts payable process. The most straightforward form is the fictitious vendor a supplier created by an employee who then submits invoices for goods or services that were never provided. The payments route to accounts the employee controls. Because accounts payable processes typically focus on approval rather than verification, fictitious vendors can operate for years.
More sophisticated schemes involve real vendors overbilling, where a vendor charges more than the contract price and shares the excess with an insider; bid rigging, where procurement employees steer contracts to favored vendors in exchange for kickbacks; and conflicts of interest, where an employee has an undisclosed ownership or financial interest in a vendor the company is paying. Detecting these schemes requires comparing vendor records against HR records and public databases, analyzing billing patterns, and interviewing employees about procurement relationships.
- Vendor master file addresses, EINs, bank accounts
- Vendor address match against employee addresses
- Invoice sequence analysis for round-dollar or sequential amounts
- Bids and contract awards against vendor relationships
- Delivery receipts and receiving documentation vs. invoices
- Conflict of interest disclosures and public records
Warning Signs That Fraud May Be Occurring
Most fraud is discovered not by auditors or investigators but by tips from employees, customers, or vendors who notice something that does not add up. The warning signs that precede tip-based detection have been well-documented in ACFE research. If your organization is experiencing several of these simultaneously, they warrant investigation rather than explanation.
Unexplained Revenue Shortfalls
Revenue that consistently underperforms operational metrics customer counts, units sold, transactions without a clear business explanation. The gap between expected and recorded revenue is the core signal of skimming.
Vendors That Cannot Be Verified
Suppliers with no web presence, no physical address, P.O. box only, or addresses that match employee residences. Invoices that lack detail, have sequential numbers, or arrive just below approval thresholds.
Lifestyle Inconsistent with Compensation
Employees in financial roles who display spending patterns vehicles, vacations, real estate that appear inconsistent with their salary. Not definitive, but documented by ACFE as one of the most consistent behavioral indicators.
Resistance to Oversight or Audit
Employees who are unusually protective of their records, resistant to cross-training others in their functions, unwilling to take vacation, or defensive when questioned about transactions they control.
Missing, Altered, or Incomplete Records
Gaps in transaction records, voided transactions without documentation, altered documents, or records that have been reconstructed after the fact. Any pattern suggesting that the documentary record does not match what actually happened.
Bank Reconciliations That Don't Clear
Accounts that are perpetually out of balance, reconciling items that persist across months, or reconciliations that are prepared by the same person who processes transactions a control failure that creates the opportunity for concealment.
Payroll Anomalies
Pay periods with unusual totals, employees receiving payments under multiple IDs, payroll addresses that match non-employee addresses, or year-end W-2 counts that exceed current headcount.
Undisclosed Vendor Relationships
Employees who advocate strongly for specific vendors without disclosed relationships, procurement decisions that bypass standard approval processes, or vendor contracts renewed without competitive bidding.
Complaints or Tips Even Vague Ones
ACFE research consistently finds that tips are the leading method of fraud detection, accounting for over 40% of discovered cases. Even vague complaints from employees, customers, or vendors that "something doesn't feel right" warrant a structured follow-up.
How a Forensic Investigation Proceeds
A forensic investigation is not an audit it is an adversarial process in which the investigator begins with a hypothesis about what may have happened and systematically tests it against the available evidence. The goal is not to find the most favorable interpretation of the records but to find out what actually occurred and to document it in a way that will hold up under the scrutiny of opposing counsel, a judge, or a jury.
Every investigation is different in its specifics, but the methodology is consistent. Evidence is gathered before the subject is aware of the investigation. The documentary record is preserved before it can be altered or destroyed. Findings are organized around a coherent narrative that links the financial evidence to a specific theory of the case. And the report is written with the eventual audience in mind whether that is a board, a judge, a jury, or a criminal prosecutor.
Confidential Intake and Scope Definition
The engagement begins with a confidential consultation to understand what is known, what is suspected, and what documentary evidence is available. We define the scope of the investigation the time period, the transactions, the individuals involved and advise on whether to structure the engagement under attorney-client privilege before any documents are requested or reviewed. The scope is deliberately limited at the outset to preserve the option of expanding it based on what the evidence shows.
Evidence Preservation and Collection
Financial records, accounting system data, bank statements, payroll records, email, and other relevant documents are collected and preserved in a format that maintains their evidentiary integrity. For digital records, this means creating forensic images or authenticated copies before any analysis begins. The preservation step is critical evidence that is altered, deleted, or moved after an investigation begins is potentially spoilated and may be inadmissible or the subject of adverse inference instructions in litigation.
Financial Record Analysis
The core analytical work of the investigation reconciling bank records to accounting records, analyzing transaction patterns, identifying anomalies that depart from expected behavior, and reconstructing the financial history of the accounts, entities, or individuals under examination. Data analytics tools are applied to large transaction sets to identify patterns not visible through manual review. Specific transactions flagged by analysis are then examined in detail with supporting documentation.
Interviews
Structured interviews with relevant employees, vendors, and witnesses conducted in a sequence that builds the factual record before the subject of the investigation is interviewed. Interview strategy in a fraud investigation is deliberate: peripheral witnesses who can establish facts without alerting the subject are interviewed first. The subject interview, if it occurs, is the last step after the documentary evidence has been organized and the investigator knows what the records show.
Loss Quantification
Calculation of the total financial harm the amount stolen or misappropriated, organized by time period, transaction type, and scheme. Loss quantification is not simply totaling suspicious transactions; it involves identifying which transactions are attributable to the scheme, applying appropriate tracing methodologies, and distinguishing legitimate from fraudulent activity within a mixed transaction population. The quantification must be defensible under cross-examination.
Findings Report
A written report documenting the methodology employed, the evidence reviewed, the findings reached, and the basis for each finding. The report is written to serve its intended audience whether an internal board review, civil litigation, or a criminal referral to law enforcement. Facts and conclusions are clearly distinguished. Opinions are supported by the evidentiary record. The report is written knowing that opposing counsel will challenge every statement it contains.
Legal Strategy and Next Steps
Following the investigation, we advise on the full range of available responses civil litigation, criminal referral, employee termination with documentation, insurance claims under a fidelity bond, and recovery strategies. Because we are both the forensic examiner and the attorney, the transition from investigation to legal action does not require a handoff. The findings inform the legal strategy directly, and the legal strategy can be implemented immediately.
Who Engages Us and Why
Forensic investigation engagements come from several distinct client categories, each with different needs and different measures of success. Understanding which category you fall into shapes how the engagement is structured and what deliverable is most useful.
You suspect an employee, partner, or vendor is stealing but you don't have proof
This is the most common entry point. Revenue is lower than expected, cash doesn't reconcile, a vendor invoice looks wrong, or an employee's behavior has changed. You need to know whether your suspicion is correct, how much has been taken, and what documentation you need to take action. We investigate confidentially, quantify the loss if fraud is confirmed, and advise on the legal options termination, civil suit, criminal referral, or insurance claim based on what the evidence supports.
You represent a client in litigation where financial records are central to the case
You need a financial expert who can analyze the records, explain what they mean to a non-financial audience, produce a report that withstands Daubert scrutiny, and testify credibly at deposition and trial. We work as a consulting and testifying expert in business disputes, fraud claims, divorce cases, and commercial litigation providing analysis and reports tailored to the evidentiary and procedural requirements of the specific proceeding.
An allegation has been raised internally and you need an independent investigation
A whistleblower tip, an anonymous complaint, or a routine audit has surfaced something that requires independent review. The board needs an investigation that is credible to outside parties regulators, insurers, lenders and that produces findings the board can act on. We conduct independent investigations under privilege to protect the results from third-party discovery while the board assesses next steps.
A former partner, shareholder, or co-owner is accused of financial misconduct
Partnership dissolutions and shareholder disputes frequently involve allegations of unauthorized distributions, undisclosed compensation, self-dealing transactions, and diversion of business opportunities. We trace the financial history of the entity, reconcile ownership accounts, and quantify the claimed misappropriation providing the financial foundation for the legal claims or defenses.
You are buying a business and want a fraud-focused review of the financial records
Standard buy-side due diligence reviews financial statements for accuracy. A forensic-focused due diligence review looks for manipulation, misrepresentation, and concealment the things a motivated seller has an incentive to hide. We apply the same investigative lens to transaction due diligence that we apply to post-discovery investigations, catching problems before the deal closes rather than after.
Expert Reports and Testimony
A forensic investigation that cannot be presented in court or that cannot withstand cross-examination is worth little more than an internal review. Every investigation we conduct is documented with the eventual evidentiary use in mind, and every report we produce is written as if it will be challenged by opposing counsel, because it often is.
Expert witness services
- Written expert reports: Produced in compliance with Federal Rule of Civil Procedure 26(a)(2) or applicable state court rules stating opinions, the basis and reasons for each, the facts relied upon, and the qualifications of the expert. Written to be understood by a judge or jury without financial expertise.
- Deposition testimony: Examination under oath by opposing counsel on the methodology, data, and conclusions in the expert report. Effective deposition preparation anticipating the specific challenges opposing counsel will raise distinguishes credible expert witnesses from those who are damaged on cross.
- Trial testimony: Direct examination and cross-examination at trial. Communicating complex financial analysis to a lay jury in a way that is understandable, credible, and consistent with the documentary record without being condescending or losing clarity in the simplification.
- Rebuttal analysis: Review and critique of opposing expert reports identifying methodological errors, unsupported assumptions, cherry-picked data, and conclusions that exceed what the evidence actually supports. Rebuttal work is some of the most valuable forensic work in litigation because opposing experts frequently overstate their findings.
- Consulting expert: Non-testifying analysis used to help counsel understand the financial issues, prepare cross-examination questions for the opposing expert, and evaluate the strength of the financial claims. Consulting expert work is fully protected as attorney work product.
We also accept referrals from other attorneys. If you represent a client in a matter where you need a credentialed financial expert fraud investigation, damages calculation, business valuation, or forensic accounting and you are not already a client of this firm, we are available for expert engagement on a matter-by-matter basis. Contact us to discuss scope, fees, and availability.
Fraud Prevention: Building Systems That Make Fraud Harder
The most cost-effective fraud engagement is the one that prevents the fraud from occurring rather than investigating it after the fact. ACFE research consistently finds that organizations with strong anti-fraud controls suffer smaller losses and detect fraud more quickly than those without. The controls that matter most are not the expensive ones they are the structural ones that remove the opportunity to commit fraud in the first place.
The fraud triangle: opportunity is the lever you control
Every fraud requires three elements: pressure (the motivation to commit fraud), rationalization (the justification the fraudster tells themselves), and opportunity (access to the system and the ability to conceal the act). Management cannot control whether employees are under financial pressure or whether they can rationalize dishonest behavior. But management can control opportunity and eliminating opportunity is the most effective fraud deterrence available.
Internal controls that reduce fraud opportunity
- Segregation of duties: No single employee should control a complete transaction cycle from initiation through authorization, recording, and custody of assets. The person who writes checks should not reconcile the bank account. The person who approves invoices should not create vendors. Segregation is the most fundamental fraud deterrence control and the most commonly violated one in small businesses.
- Independent bank reconciliation: Bank accounts should be reconciled by someone other than the person who processes payments and the reconciliation should be reviewed by management or an owner who understands what they are looking at. Unreviewed bank reconciliations are one of the most consistently documented control failures in fraud cases.
- Dual authorization for disbursements: Payments above a defined threshold require approval from two authorized individuals. This eliminates the single-person payment authorization that enables most embezzlement schemes.
- Vendor master file controls: New vendors should require documentation and approval from someone other than the person who processes payments. The vendor master file should be periodically reviewed for inactive, duplicate, or suspicious entries.
- Mandatory vacation and job rotation: Fraud schemes typically require ongoing concealment they collapse when someone else performs the function during the fraudster's absence. Mandatory vacation for financial personnel is a deterrence and detection control, not simply an HR benefit.
- Anonymous reporting hotline: ACFE data shows that tips are the leading fraud detection mechanism, and that organizations with hotlines detect fraud faster and at lower cost. The hotline must be genuinely anonymous, actively publicized, and its reports actually investigated not simply acknowledged and filed.
- Owner-level financial review: Owners and executives who review financial statements should understand what they are reviewing including what anomalies look like. A monthly management review that covers accounts payable aging, payroll totals, and bank reconciliations is a low-cost, high-deterrence control that many small businesses simply do not do.