CFF cheat sheet

Fraud triangle: pressure/incentive, opportunity, and rationalization must coexist for most occupational frauds; removing any one leg reduces risk.

ACFE occupational fraud taxonomy has three branches: asset misappropriation (most frequent, least costly per case), corruption, and financial statement fraud (least frequent, most costly per case).

Fraud examination is a four-stage discipline: (1) identify and obtain evidence of fraud, (2) document and quantify the loss, (3) interview witnesses and suspects, (4) testify to findings.

Forensic accounting differs from auditing: auditing tests assertions for material misstatement; forensic work answers a specific investigative or litigation question with evidence admissible in proceedings.

Evidence hierarchy for financial forensics: original documents > authenticated copies > testimony; documentary evidence must be authenticated and shown to be free of alteration.

Fraud risk factors under AU-C 240 / ISA 240: incentive/pressure, opportunity, and attitude/rationalization, assessed at both financial statement and assertion levels.

Chain of custody: every transfer of evidence is logged (who, what, when, where, why); a break in the chain can render evidence inadmissible or reduce its weight.

Professional skepticism in forensic work means corroborating management representations with independent evidence rather than accepting them at face value.

Benford's Law: in naturally occurring multi-digit data, leading digit 1 appears about 30.1% of the time, 2 about 17.6%, 3 about 12.5%; deviation signals possible fabrication, not proof.

Vertical analysis expresses each line item as a percentage of a base (revenue on the income statement, total assets on the balance sheet); horizontal analysis compares the same line across periods.

Ratio diagnostics for fraud: rising revenue with falling cash flow, receivables growth outpacing sales, and inventory turnover deterioration are classic red flags.

Net worth (source-and-use) analysis: unexplained increases in a subject's net worth, after adjusting for known income, indicate possible unreported or illicit income.

Bank reconciliation forensics: look for kiting (transferring funds between accounts to cover a shortage), lapping (rolling customer payments), and stale outstanding checks.

Computer-assisted audit techniques (CAATs) for forensics include duplicate payment testing, gap detection in check/invoice sequences, and Benford digit tests.

Sampling for forensics is typically non-statistical and targeted (high-risk, unusual, or related-party transactions) rather than random, because the goal is to find anomalies.

Data analytics red flags: round-dollar amounts, weekend/holiday postings, duplicate vendor addresses or bank accounts, and employees sharing a vendor's address.

Asset misappropriation subtypes: skimming (cash taken before recording), larceny (cash taken after recording), and fraudulent disbursements (billing, payroll, expense reimbursement, check tampering, register disbursements).

Billing schemes: shell company (fictitious vendor), pass-through (legitimate vendor overbills and kicks back), and personal purchases with company funds.

Payroll schemes: ghost employees, falsified hours or salary rates, commission schemes, and workers' compensation fraud.

Financial statement fraud schemes: fictitious revenue, timing differences, concealed liabilities and expenses, improper asset valuations, and improper disclosures.

Revenue recognition fraud red flags: sales to related parties, round-trip transactions, side letters, bill-and-hold arrangements, and receivables that never convert to cash.

Corruption schemes: bribery (kickbacks, bid rigging) and illegal gratuities; conflicts of interest; economic extortion.

Kickback detection indicators: vendor prices above market, single-source vendors, unusually loyal relationships with one buyer, and vendor payments to employees or relatives.

Concealment methods: falsified journal entries (top-side entries, unusual accounts), altered documents, destroyed records, and collusion to override controls.

Expert witness vs. fact witness: an expert may offer opinions based on specialized knowledge; a fact witness testifies only to what was observed or done.

Daubert standard (federal): expert testimony must rest on sufficient facts, reliable methods, and proper application; the court acts as gatekeeper.

Frye standard (some state courts): the method must be generally accepted in the relevant scientific community.

Report structure for a forensic engagement: scope, methodology, findings, quantification of loss, limitations, and basis for conclusions.

Damages measurement approaches: lost profits (but-for analysis), out-of-pocket loss, disgorgement, and restitution; each requires a defensible causal link.

Engagement letter should define scope, objective, standards applied, fee basis, and limitations; a forensic engagement is not an audit and does not express an audit opinion.

Attorney-client privilege and work product: forensic work performed at counsel's direction may be privileged, but facts underlying the work are generally discoverable.

Professional standards: AICPA Statement on Standards for Forensic Services (SSFS) and the ACFE Code of Professional Ethics govern independence, objectivity, and confidentiality.