CFF key terms

The practice of examining financial records, transactions, and reporting to detect fraud, quantify losses, or support litigation, combining accounting knowledge with investigative and evidentiary techniques.

Applying accounting, auditing, and investigative skills to matters that may end up in court, including fraud investigations, damage quantification, and expert testimony on financial disputes.

A structured process of resolving fraud allegations from inception to disposition, covering detection, investigation, evidence gathering, documentation, and reporting of findings to the retaining party.

A model explaining occupational fraud through three conditions: pressure or incentive, opportunity, and rationalization. Investigators use it to assess which employees or processes carry elevated fraud risk.

An extension of the fraud triangle that adds capability, recognizing that the person committing fraud needs the position, knowledge, and confidence to execute and conceal the scheme.

A systematic review of an organization's processes and controls to identify where fraud could occur, how likely it is, and what detection or prevention steps should be prioritized.

A fraud scheme in which an employee steals or misuses an organization's resources, such as skimming cash, submitting false invoices, or taking inventory, usually without falsifying financial statements.

Deliberate misstatement or omission of amounts in financial reports, such as inflating revenue or hiding liabilities, intended to mislead investors, lenders, or other users of the statements.

Fraud schemes in which an employee misuses their influence in a business transaction to obtain an unauthorized benefit, including bribery, kickbacks, bid rigging, and conflicts of interest.

Stealing cash before it is recorded in the accounting system, so the receipts never appear on the books and the theft is harder to detect through record comparison.

Theft of cash that has already been recorded in the books, distinguishing it from skimming because the missing funds create a visible discrepancy in recorded receipts.

Concealing stolen cash receipts by applying a later customer's payment to an earlier customer's account, rotating the shortage forward until it is covered or detected.

A scheme where an employee alters, forges, or diverts a check written on the organization's account, such as changing the payee or intercepting a signed check before mailing.

Submitting false or inflated expense claims for reimbursement, including fabricated receipts, duplicate submissions, or claiming personal costs as business expenses.

A fake supplier created or used by an employee to receive payments for goods or services never provided, often supported by forged invoices and approval documentation.

A fraud in which an employee causes the organization to pay for goods or services that were not actually received, often through a shell company or an inflated invoice from a real vendor.

A secret payment made to an employee by a vendor or contractor in exchange for favorable treatment, such as awarding contracts or approving inflated invoices.

Offering, giving, receiving, or soliciting something of value to influence a business or official decision, a core corruption scheme in fraud examinations.

A situation where an employee's personal or financial interest could improperly influence their business decisions, often concealed through undisclosed related-party transactions.

Two or more people cooperating to commit or conceal fraud, which defeats controls designed around segregation of duties because each participant's actions appear legitimate in isolation.

An internal control that divides authorization, custody, and recordkeeping among different people so no single employee can initiate and conceal a fraudulent transaction.

The policies and procedures an organization uses to safeguard assets, ensure reliable reporting, and promote compliance, including preventive and detective controls relevant to fraud risk.

Recording revenue before it is earned or when no sale occurred, such as shipping unordered goods, holding period-end sales open, or recognizing revenue on contingent arrangements.

Overstating a liability or expense reserve in a strong period, then releasing it in a weak period to smooth earnings and meet analyst or lender expectations.

An arrangement where two parties sell similar assets or services to each other to inflate revenue on both sides, creating the appearance of legitimate sales activity.

Using legitimate discretion within accounting rules to influence reported results, which becomes fraudulent when it crosses into deliberate misstatement or concealment.

A deal between an organization and an entity or person connected to its insiders, which requires disclosure because terms may not reflect arm's-length bargaining.

The documented, unbroken record of who handled evidence, when, and how it was stored, used to show that items presented in proceedings are authentic and unaltered.

Creating a bit-for-bit copy of a storage device or dataset for analysis, preserving the original as evidence while the working copy is examined and hashed for integrity.

Establishing that a document, record, or data file is what its proponent claims it is, often through testimony, hashes, metadata, or comparison with known samples.

Opinion evidence given by a qualified specialist about matters beyond ordinary lay knowledge, subject to standards on reliability, methodology, and relevance in the proceeding.

Assisting attorneys in a dispute by analyzing financial records, quantifying damages, preparing exhibits, and explaining findings, distinct from testifying as an expert.

The expectation that leading digits in many natural datasets follow a predictable distribution, so unusual deviations in a transaction population can flag possible fabrication or manipulation.

Applying queries, statistical tests, and pattern analysis to full transaction populations to identify anomalies, outliers, and relationships that sampling or manual review would miss.

A warning indicator or anomaly, such as unusual journal entries, lifestyle changes, or control overrides, that suggests increased likelihood of fraud and warrants further inquiry.

The threshold at which a misstatement or omission could influence the decisions of financial statement users, guiding what must be corrected, disclosed, or investigated further.

Following a transaction forward from source documents to accounting records to confirm it was recorded, a technique used to test completeness of recorded activity.

Selecting an entry in the accounting records and working backward to supporting documents to confirm the transaction occurred and was properly authorized and recorded.

The documented path of a transaction from origination through posting and reporting, which allows investigators to reconstruct who did what and when.