State the question without declaring the conclusion
Describe the suspected event or unexplained financial pattern and the decision the investigation will support. Preserve uncertainty about who acted and why. A request to investigate unusual payments allows the professional to follow the evidence; an instruction to prove a named person's wrongdoing can distort the assignment from the start.
AICPA's guidance on requests for a forensic audit explains that the term can confuse forensic work with a financial statement audit. Ask the candidate to name the service, objective and limitations precisely. The engagement should describe an investigation rather than promise that every possible fraud or error will be detected.
References: AICPA: Responding to requests for a forensic audit
Preserve evidence through an approved process
Have counsel, information security and the investigator agree how relevant records will be preserved and collected. Identify systems, dates and custodians without instructing staff to alter or delete records. If digital forensics is needed, commission that expertise explicitly. Ordinary accounting exports may not preserve everything an investigation requires.
Specify who may contact employees, vendors or other parties and how interviews are authorized and documented. Avoid parallel informal investigations that change records or spread untested allegations. Management should know how urgent risks are escalated while the investigative team preserves an accurate record of what it observed.
Keep access proportionate and documented. The specialist should explain what information is needed and why. Where a requested source is unavailable or legally restricted, record the limitation and ask how it affects the work rather than assuming the absence supports the allegation.
Separate the investigation from remediation and proceedings
A completed investigation may lead to accounting corrections, control changes, employment action, insurance notification or legal proceedings. Assign those decisions to appropriate owners and advisers. Do not assume they are included in the forensic fee or that the investigator has authority to make them for the company.
Retain the final report and evidence under the agreed custody and access arrangements. Confirm any future testimony, authority response or expert-report work separately. The engagement should end with a clear statement of what was examined, what the evidence supports and what remains unresolved, including a finding that the original suspicion was not established.
Sources
Requirements and product details can change. Check the linked guidance for the facts that apply to your situation.
Related reading
Need help with this work?
General information, not personalized accounting, tax, legal, or investment advice. Have the appropriate qualified professional review decisions that depend on your circumstances.