Forensic Accounting: Spotting Employee Fraud

Forensic accounting is the practice of examining a company’s financial records to detect, measure, and document fraud in a form that will hold up in court. For a closely held Denver or Littleton business, the exposure is concrete. The Association of Certified Fraud Examiners (ACFE) reports that organizations with fewer than 100 employees lose a median of $141,000 per occupational-fraud case. That is the second-highest loss of any size category. It is larger than most mid-size companies absorb, and it lands on the businesses least equipped to survive it.

Small firms are exposed because they have the fewest controls. One bookkeeper often records deposits, cuts checks, and reconciles the bank statement. This guide walks through the common employee-fraud schemes, the red flags for each, the internal controls that stop them, and when a Colorado business owner should bring in a forensic accountant.

What Is Forensic Accounting, and What Does a Forensic Accountant Do?

A forensic accountant investigates suspected financial wrongdoing and builds a documented case that can survive legal scrutiny. The work combines accounting depth with an investigator’s method: tracing transactions, reconstructing records, quantifying loss, and producing evidence an attorney or court can use. It is targeted at a specific suspicion, not a routine review of the books.

The American Institute of CPAs defines this scope through its Certified in Financial Forensics (CFF) credential, describing it as the mark for CPAs who apply financial expertise with investigative insight to matters involving fraud, litigation, and complex financial disputes, spanning fraud prevention, detection, and response, financial-statement misrepresentation, bankruptcy, economic damages, and valuations, per the AICPA CFF credential page.

Court-ready proof matters because fraud is a legal finding, not an accounting opinion.

“Fraud involves obtaining something of value through willful misrepresentation,” a determination made “through the judicial or other adjudicative system.” — U.S. Government Accountability Office, Fraud Risk Management (GAO-23-106567)

What Are the Most Common Types of Employee Fraud in Small Businesses?

The most common employee frauds in small businesses are asset-misappropriation schemes: billing, check and payment tampering, payroll, expense reimbursement, skimming, and cash larceny. The ACFE’s Occupational Fraud 2024: A Report to the Nations found these schemes were more common in smaller organizations than in larger ones, precisely because small firms rarely separate the duties that would catch them.

Each scheme has a signature. Billing fraud routes money to fake or inflated vendors. Check tampering alters or forges payments. Payroll fraud invents ghost employees or padded hours. Expense fraud reimburses personal or fictional costs. Skimming takes cash before it is recorded; cash larceny takes it after. The ACFE’s study drew on 1,921 real cases across 138 countries from January 2022 to September 2023. Those cases totaled more than $3.1 billion in losses.

Which Internal Control Stops Each Fraud Scheme?

Each scheme is stopped by separating a duty the fraudster currently controls alone. The table below maps each of the six common schemes to a red flag an owner can watch for and the specific preventive control that closes the gap. Three controls cut across all of them: segregation of duties, mandatory vacations (so a hidden scheme surfaces while its operator is away), and surprise audits.

What Red Flags Indicate an Employee May Be Committing Fraud?

The strongest early signal is behavioral: 84% of fraudsters displayed at least one behavioral red flag before they were caught, according to the ACFE. The single most common is living beyond their means, present in 39% of cases, meaning visible affluence that does not match a known salary. These cues matter because they appear long before the numbers do.

The recurring warning signs the ACFE tracks are living beyond means, known personal financial difficulties, an unusually close association with a vendor or customer, control issues such as an unwillingness to share duties or take time off, general irritability or defensiveness, and a wheeler-dealer attitude. The stakes rise with these signs: perpetrators showing at least one red flag caused a median loss of $150,000, versus $125,000 for those showing none, about 20% higher.

How Do You Detect Employee Fraud in a Small Business?

The most productive way to detect employee fraud is a tip. Tips uncovered 43% of occupational frauds in the ACFE study, more than three times the next method, and employees supplied 52% of those tips (customers 21%, vendors 11%). That is why an anonymous reporting hotline is the highest-return control a small business can add.

The evidence on hotlines is direct. Organizations with them had a median loss of $100,000 versus $200,000 without, and a median duration of 12 months versus 18 months. That roughly halves the damage. After tips, the next-best detectors are internal audit (14%) and management review (13%). External financial-statement audits caught just 3% of frauds, and 5% were found by accident. Because the typical scheme runs about 12 months before discovery, the longer an owner waits to look, the larger the loss grows.

How Much Does a Forensic Accountant Cost for a Small Business?

Forensic engagements are billed by scope rather than a flat fee, and the labor anchor is public: the U.S. Bureau of Labor Statistics reports a May 2024 median wage of $39.27 per hour ($81,680 per year) for accountants and auditors, with the top 10% above $141,420, per the Occupational Outlook Handbook. Credentialed forensic specialists command more than the base occupation, since the work carries litigation risk and evidentiary standards.

Weigh that against the exposure. With a median small-business fraud loss of $141,000 and an estimated 5% of revenue lost to fraud each year, a right-sized forensic review is small relative to what an undetected scheme removes over its roughly 12-month life. The right question is not the hourly rate but whether the suspected loss justifies a documented investigation.

What Is the Difference Between Forensic Accounting and a Regular Audit?

A financial-statement audit tests whether the statements are fairly presented as a whole; forensic accounting is a targeted investigation built to prove or disprove a specific fraud in court. The difference is measurable in outcomes: external audits detected only 3% of occupational frauds in the ACFE data, because they are not designed to chase a concealed scheme. A forensic accountant is.

Forensic work is also built to an evidentiary standard because fraud is ultimately decided by a court. IRS Criminal Investigation, whose special agents perform federal financial forensics, states it achieves “more than a 90 percent federal conviction rate” and is “the only federal law enforcement agency with investigative jurisdiction over violations of the Internal Revenue Code,” per its official Criminal Investigation page. In FY2025, IRS-CI identified $10.59 billion in financial crimes.

When Should a Denver Business Bring In a Forensic Accountant?

Bring in a forensic accountant when a specific suspicion has surfaced and the numbers no longer reconcile. The triggers are concrete: unexplained shortages, a vendor no one can verify, a bookkeeper who will not take vacation, or a behavioral red flag paired with a cash gap. More than half of frauds trace to a lack of internal controls (32%) or an override of existing ones (19%). A Colorado owner who spots these signs is usually facing a real scheme, not an error.

What this means for you: if you suspect an employee is stealing, do not confront the person first. Preserve the records quietly, limit who knows, and engage a CPA-led forensic professional before evidence can be altered. Premature confrontation is how documentation disappears and how a recoverable case becomes an unprovable one.

Related: our advisory and consulting services help owners design the segregation-of-duties controls above, and our assurance services provide the independent review that surfaces schemes an internal team can miss. For plan sponsors, our employee benefit plan audits test the payroll and contribution records where ghost-employee and payroll schemes hide.

Frequently Asked Questions

What does a forensic accountant do?

A forensic accountant investigates suspected financial wrongdoing and documents it to a standard that holds up in court. The work traces transactions, reconstructs records, quantifies the loss, and produces evidence attorneys or a court can use. Unlike a routine audit, it targets a specific suspicion rather than reviewing the books as a whole.

Can a forensic accountant testify in court?

Yes. Forensic accounting produces court-admissible results, and forensic accountants are frequently engaged as expert witnesses. Fraud itself is a legal determination made “through the judicial or other adjudicative system,” per the GAO, so the discipline is built to an evidentiary standard from the outset.

How can a small business prevent employee fraud?

Separate the duties a single employee currently controls alone, add an anonymous reporting hotline, and run surprise audits and mandatory vacations. Hotlines alone are associated with median losses of $100,000 versus $200,000 without one, and tips detect 43% of all occupational fraud, so a reporting channel plus basic segregation of duties is the highest-return defense.

Contact Us: If you suspect employee fraud or want to close the control gaps above, contact WhippleWood CPAs to speak with a Denver-area CPA. Email info@whipplewood.com to arrange a confidential discussion.