When one person controls authorization, custody of assets, recordkeeping, and reconciliations, the opportunity to both commit and conceal fraud is very high. From a forensic accounting perspective, concealment often relies on making the accounting records appear internally consistent, rather than preventing the theft itself.
The most common concealment methods include:
| Concealment technique | How it works |
|---|
| Fictitious journal entries | Manual entries are used to shift losses into expense accounts, write-offs, or balance sheet accounts to keep the books balanced. |
| Altered bank reconciliations | Outstanding checks, deposits in transit, or reconciling items are fabricated or allowed to remain unresolved month after month. |
| Voided or deleted transactions | Legitimate receipts or payments are voided after processing to hide missing cash. |
| False vendor payments | Payments are recorded as legitimate operating expenses using shell vendors, inactive vendors, or vendors with altered banking information. |
| Duplicate payments | A vendor is paid twice, with one payment diverted to an account controlled by the perpetrator. |
| Expense misclassification | Theft is hidden within broad accounts such as repairs, consulting, miscellaneous expense, supplies, or prepaid assets. |
| Fictitious accruals or reversals | Accruals are created or reversed to manipulate the timing of expenses or conceal shortages. |
| Write-offs | Inventory, receivables, or other assets are written off to disguise stolen cash or diverted collections. |
| Lapping (for receivables) | Incoming customer payments are applied to earlier stolen receipts, creating a rolling concealment that requires continual manipulation. |
| Check substitution | A fraudulent check is concealed by replacing supporting documentation or altering payee information in the accounting records. |
| Payroll manipulation | Ghost employees, inflated hours, unauthorized bonuses, or altered direct deposit information are used to divert funds. |
| Inter-account transfers | Funds are temporarily moved between accounts around reporting dates to disguise shortages. |
For cash skimming (cash stolen before it is recorded), common concealment methods include:
- Understating sales or revenue.
- Issuing unauthorized discounts or refunds.
- Recording fictitious bad debts.
- Voiding sales after customers leave.
- Delaying the recording of receipts.
- Manipulating inventory records to match reduced sales.
For fraudulent disbursements, common schemes include:
- Shell companies controlled by the perpetrator.
- Payments to legitimate vendors using altered banking instructions.
- Personal expenses submitted as business expenses.
- Fake consulting or professional service invoices.
- Ghost employees on payroll.
- Unauthorized wire transfers.
- Forged or altered checks.
When the perpetrator controls the entire accounting cycle
If the CFO can:
- authorize payments,
- sign checks,
- post journal entries,
- and reconcile the bank,
traditional internal controls become ineffective because the same individual can create both the fraud and the documentation supporting it.
In these situations, forensic accountants often place greater emphasis on evidence that exists outside the accounting system, such as:
- Original bank records obtained directly from financial institutions.
- Cleared check images and ACH or wire details.
- Vendor existence verification.
- Vendor bank account ownership analysis.
- Tax filings and payroll reports.
- Email approvals and contract documentation.
- Board minutes authorizing significant expenditures.
- Confirmation with customers and vendors.
- Digital audit logs showing when records were created or modified.
- Analysis of unusual journal entries, especially those posted after business hours, near period-end, or directly to cash-related accounts.
Analytical procedures can also be valuable. Examples include:
- Benford's Law testing (where appropriate).
- Trend analysis of expenses over time.
- Duplicate payment analysis.
- Sequential gaps in check numbers.
- Vendor address, phone number, and bank account matching.
- Round-dollar payment analysis.
- Searches for employees and vendors sharing addresses, bank accounts, or tax identification details.
- Identification of manual journal entries affecting cash, receivables, or expense accounts.
In a case involving a CFO with complete control over accounting functions, the strongest evidence typically comes from independent third-party records (banks, vendors, tax authorities, and counterparties) and digital audit trails, because these are much harder for the suspected individual to alter than the company's own books and reconciliations.
