CVA study materials
CVA study resources

CVA (Mile2 Cybersecurity Certifications): Forensic Accounting

CVA · Work through your exam, one topic at a time.

All guide sections

Forensic Accounting

Forensic Accounting tests fraud examination and investigative accounting: recognizing schemes, preserving evidence, tracing transactions, and converting accounting records into defensible findings. It overlaps with auditing but is retrospective and often adversarial.

Core rules and concepts

  • The fraud triangle explains incentive or pressure, opportunity, and rationalization; it is a risk model, not proof of fraud.
  • The ACFE fraud tree groups schemes into asset misappropriation, corruption, and financial statement fraud. Asset misappropriation includes skimming, cash larceny, billing schemes, payroll schemes, and expense reimbursements.
  • Auditing standards such as AU-C 240 require auditors to consider fraud risk, but an audit is not a fraud investigation.
  • Evidence handling requires documentation, chain of custody, and preservation of metadata; interviews should be planned and corroborated.
  • Investigative methods include bank-statement analysis, proof of cash, tracing, source-and-application of funds, net worth analysis, and data analytics such as Benford's law.
  • Benford's law identifies anomalous digit patterns; it does not by itself prove manipulation.
  • Reports distinguish observed facts, assumptions, and conclusions, and address alternative explanations.

Worked example

A subject's net worth rises from $200,000 to $350,000 in one year, an increase of $150,000. Personal living expenses are $80,000 and nonbusiness receipts are $40,000. Inferred income is $150,000 + $80,000 - $40,000 = $190,000. If reported income was $90,000, the unexplained amount is $100,000, which requires corroboration and an opening-net-worth reconciliation.

Traps

Treating an anomaly as proof of fraud; failing to account for cash and assets in net worth analysis; breaking chain of custody; ignoring innocent explanations; and presenting a fraud conclusion without linking scheme, intent, and financial effect.