It is now generally accepted that forensic accountants form an integral part of large-scale complex cross-border fraud investigations. This has not always been the case and raises the question as to whether forensic accountants are essential. In short, in the past the answer would have been no. In times gone by, fraud investigations would be undertaken by specialist investigators, many of whom were former enforcement officers. An accountant would be used specifically to look at the transactions in the books and records. A forensic accountant is not necessarily a specialised fraud investigator and, before forensic accounting became mainstream, fraud investigators managed without them.

However, the number and scale of international investigations has multiplied over the last few years and this has coincided with a significant increase in the range of skills and specialisms that the major forensic accounting teams now possess. Although the term 'forensic accountant' has a relatively narrow interpretation when it comes to the role of expert witness in litigation and arbitration matters, in terms of investigations it is now a generic description that extends its boundaries beyond accountants and accounting: it encompasses a diverse range of skills and expertise that is invaluable in complex investigations. This is not just traditional accounting analysis but also: (1) providing expert evidence in fraud bribery and corruption trials; (2) interviewing of witnesses; (3) imaging of devices; (4) data mining; (5) data interrogation; (6) data hosting; (7) provision of sector experts and industry knowledge; (8) asset tracing; (9) asset recovery; and (10) corporate intelligence. A forensic accounting practice typically offers forensic technology and e-disclosure services, large-scale document review capability, corporate intelligence skills and the ability to undertake general investigations. Furthermore, the size and diversity of offerings found in the larger accounting firms also allows an investigation team to bring in specific sector specialisms, utilising the powers of insolvency practitioners and valuation experts to support recovery efforts. Consequently, forensic accountants are commonly used by companies and their legal counsel to fulfil a wide range of investigative roles outside that of pure technical financial analysis.

This diversification in the role of the forensic accountant can be put down, in a large part, to two significant shifts in the business environment. Firstly, it is a response to globalisation, and the increasingly international nature of businesses, regulatory scrutiny and thus investigations. A large accounting firm will have professionals based in most countries of the world; it, therefore, will offer organisations and legal counsel the ability to deploy local resources quickly. It also reflects the fact that aspects of large international investigations are heavily process-driven; as such, the skills and experience of legal counsel may be better focused on strategy and litigation. Secondly, the effect of digitisation means that the volume of data that needs to be collected and analysed has grown exponentially and it is forensic accounting teams that have invested heavily and now possess market leading expertise in this area.

Clearly, we are in an ever-changing world that has been highlighted in the most extreme of terms by the events of the first quarter of 2020. It will be some time before the full effects are known on the way that we interact and do business. What is certain is that new ways of working remotely, harnessing the power of technology, have come to the fore and these are likely to stay with us in one way or another. This will inevitably change the way in which investigations are carried out and, in turn, will undoubtedly lead to greater reliance on, and even faster growth in, the use of forensic technology. That said, it is likely that the fundamental principles underlying investigations will remain the same.

The role of the forensic accountant in international investigations in general follows a standard template: investigating the facts and circumstances underlying the issue through the analysis of financial records and interviews, supporting the document review and disclosure process, tracing the destination of any misappropriated funds or assets, and assisting with recovery efforts. Indeed the modern forensic accountant may be judged by the tools and techniques that can be brought to an investigation, rather than by the traditional core set of accountancy skills; understanding the techniques for extracting and analysing data or recovering assets in far-flung territories is as important now as an appreciation of the financial statements.

It goes without saying that the forensic accountant is not the only party involved in investigations. They form part of a wider multi-disciplinary team, both alongside specialists that are now deemed to fall under the 'forensic accounting' umbrella and together with management, in-house counsel, external lawyers and, on occasion, regulators.

II Financial analysis

As outlined above, the traditional role of the forensic accountant in investigations has been focused on the analysis of financial and accounting records. Although forensic accounting is now much broader than this, focused accounting analysis is still relevant. In general terms, any fraud, bribery or financial misconduct will be reflected in, and evidenced through, the financial and accounting records of an organisation. While a payment or transaction may be disguised or hidden, its existence will be recorded in the accounts, any absence producing an imbalance or reconciliation error and a pointer to an issue for the entity's management.

Thus, for example, the payment of bribes by an organisation may be recorded as, notionally, a legitimate expense: in the accounts payable ledger; as employee expenses or commissions; or as discounts in the accounts receivable ledger. The direct cost of procurement fraud may be disguised through the accounts payable ledger. Overly aggressive revenue recognition would be recorded in the accounts receivable ledger.

In the case of manipulation that is entirely 'off the books' as in the case of business diversion schemes where neither revenues nor any costs of sales are recognised in an organisation's books and records, forensic analysis may be able to identify likely loss of profits from analysis of failed growth forecasts and other indicators such as falling market share.

Accounting treatments, and the individual technicalities of the underlying transactions can vary significantly between countries, industry sectors and size of organisations. Certain industries have their own terminology, acronyms and jargon. It goes without saying that having the right mix of forensic accounting and sector-specific knowledge and experience in the investigation team is essential together with an appreciation of cultural differences; it may, for example, be desirable to include project accounting experience for an investigation at a construction company, or specific natural resources hedging expertise for a mining company.

Information gathering is a key component of a forensic accountant's work and interviews form an important part of this. It would be very easy to undertake an analysis of accounting records that failed to progress an investigation if carried out blind. Hence, the accounting analysis benefits greatly from being informed and focused. The most effective accounting records analysis is performed with a full understanding of how the specific operations of the organisation in question relate to the underlying accounting records and suspected misconduct. The best way of achieving this is by interviewing. In general, although the interview process is more often than not conducted by legal counsel, in situations where a fraud or its concealment involves even moderately complex accounting manipulation or concealment, it is likely to be beneficial to include forensic accountants in the interviews.


The world that we now live in is driven by technology and, as outlined in the introduction to this chapter, the events of 2020 have increased such reliance. It is difficult to imagine what our existence would be like without the digital revolution. Our computers, telephones and other mobile devices contain a digital fingerprint of our lives, both personal and business.

The volume of electronic data that we create on a daily basis has exploded and continues to grow exponentially. Ninety per cent of the world's existing data has been created in the last two years:2 a single computer can hold several million documents; a typical mailbox will contain 50 to 100,000 emails. The volume of potentially relevant records of a global business involved in an international investigation may number hundreds of millions. In addition, the types of data being generated have drastically changed and become more complex. We now communicate in different ways through, for example, the use of Skype, WhatsApp and the like. These continual developments render the traditional methods of data capture, processing and analysis obsolete. We must also consider the evolving business and regulatory environments; business has become increasingly global, while there is a growing emphasis placed on data protection and cybersecurity.

In order to address these changes, new technology and methodologies are constantly being developed; this is an area that is moving rapidly. The most significant developments are outlined below but it may be that, because change is so rapid, they will already be out of date.

i Disclosure Pilot Scheme

As of 1 January 2019, a Disclosure Pilot Scheme has been in operation (with limited exceptions) in the Business and Property Courts of England and Wales. This aims to address the cost, scale and complexity of the disclosure process and encourage the use of new technologies to make the process more efficient and economical.

ii Data collection and analysis

Data scoping is now an essential element of any data collection exercise; it is imperative that all sources of potentially relevant data are identified and located to plan an efficient and defensible strategy. A plethora of tools have been developed to capture and analyse the various types of data that are commonplace. These include audio-visual data, social media, instant messaging and workplace collaboration applications.

The prevalence of multinational companies that operate across country borders has driven an increased demand for a more cost-effective and efficient solution for the review of multilingual data. It is now the case that machine translation is a viable alternative to human translation. For the purpose of e-disclosure, this process can be fully integrated with the review platform to allow reviewers to seamlessly translate documents during the course of their work.

iii Cloud

Increasingly, companies are moving their corporate data to cloud-based systems to take advantage of cheaper storage. The e-disclosure industry is following suit; many of the largest e-discovery software providers now offer the option of a cloud-based solution, and many challengers are now entering the market with purely cloud-based offerings.

iv Artificial intelligence

Predictive coding has been touted as a miraculous solution to large and complex e-disclosure matters since the late 1990s. However, there has been a reluctance in the market to adopt this review strategy, particularly after a number of high-profile project failures resulting from poor planning or understanding. Since its judicial approval in the US in 2012, predictive coding has become a more accepted workflow, albeit in a measured capacity, because of more realistic expectations and a better understanding of its capabilities.

Further, the technology behind predictive coding has become more sophisticated; applications can now continuously learn from user input to constantly prioritise the most likely responsive data. This continual learning technology has had a quicker adoption than predictive coding, because of the simple implementation and more transparent workflow.

In addition to the above, many tools now offer investigators various options to analyse unstructured data without the use of keywords, such as through concept searching, sentiment analysis or the use of communication maps. These platforms allow the investigator to carry out simple early case assessment as well as discovering and exploring issues that may not have previously been identified.

Similar strides have been taken with regard to structured, typically financial, data. Platforms exist that automatically ingest significant volumes of transactional data from the most commonly used accounting systems and apply a number of tests to each, in order assign a risk score to every transaction. The system can also be trained on vast quantities of financial data to build an artificial intelligence model, thus negating the need for specific tests, but allowing anomalous transactions to be flagged automatically. The use of these technologies can identify the high-risk transactions within millions of records in minutes, and more effectively than the human eye. For example, anomalous flows of funds can be identified, which would be near-impossible for a human to detect.


The challenges faced when attempting to trace assets are numerous: today's sophisticated fraudster is able to move assets quickly, making use of the mobility of assets and funds offered by globalisation, by channelling and directing them through different jurisdictions and by changing their form. Cash can be moved effortlessly, through multiple jurisdictions and converted into non-cash assets, often being split and divided and channelled in different directions. We are commonly dealing with financially astute fraudsters who are able to take action to move and hide their stolen proceeds and take steps to frustrate recovery attempts by the legitimate owners. We are now also encountering the challenges of tracing when faced with cryptocurrencies, the fraudster seeing the attractions of the market's pseudo-anonymity, decentralised nature, and loose regulation and exploiting this to launder the proceeds of the crime. While, with traditional money, fraudsters employ complicated and often sophisticated techniques involving shell companies, offshore bank accounts (sometimes temporary in nature), use of nominees, gatekeepers and other such intermediaries, in the case of cryptocurrencies, they may use various anonymisation techniques in attempts to obscure the money trail. On the face of it, this makes the potential for tracing impossible. However, one of the defining features of a cryptocurrency is that its ledger, which contains all transactions that have ever taken place, is globally visible. Interestingly, research has demonstrated that it is often possible to track flows of money as it changes hands, and in some cases to de-anonymise users entirely, even in cryptocurrencies that are specifically designed to achieve anonymity. This is an extremely important factor in relation to the tracing of funds being moved through the non-conventional financial system.

Whatever method is used by the fraudster to move the assets, victims and their legal advisers must embark upon an often lengthy and complex process of asset tracing to determine the location of the assets and to link identified assets to the crime and the offender. Every asset-tracing exercise has its unique complexities, but inevitably includes a more or less iterative process of gathering and analysing evidence of asset movement.

Tracing is an almost entirely linear process: following an asset as it is moved or substituted for another and, thereafter, another and so on. While assets may be split and recombined, and mixed with other funds, the tracing exercise moves in an essentially chronological progression. In a conventional asset tracing exercise, banking records in particular are the bread and butter, representing an accurate and reliable source of evidence. Indeed, it is often the case that the only record of a flow of assets will be held by the financial institution facilitating the transaction.

Even once the flow of assets has been established, there are further hurdles that need to be negotiated. Before steps can be taken to secure and freeze identified assets, by applying legal remedies such as search and third-party disclosure orders to obtain further evidence of asset movement, the rules of tracing need to be considered. The tracing exercise is merely a process by which a claimant demonstrates what has happened to his or her property, identifies its proceeds and the persons who have handled or received them, and justifies his or her claim that the proceeds can properly be regarded as representing his or her property.3 In English law, for example, there are separate rules in common law and equity that determine whether or not an asset is traceable.

Common law tracing relies on the claimant having legal ownership of the property. It will fail if the property has been mixed with other property or the legal title has been transferred to anyone other than the victim. Where specific assets identified by common law tracing can be identified, a claimant will be entitled to claim them as his or her property. However, the major obstacle in respect of common law tracing is that assets cannot be traced once mixed with other funds. Tracing is, however, allowed through 'clean substitutions', meaning that if misappropriated funds are directly used to purchase another asset, ownership can be traced to and claimed in that substitute asset.

Due to the limits with common law tracing, equitable tracing is more commonly encountered in practice. It relies on there being an equitable interest in the property and can succeed where there has been mixing. Given that it is likely that the proceeds of a misappropriation will be transferred into a bank account containing funds belonging to others, the equitable remedy is important for victims of fraud.

Notwithstanding the above, the English courts in particular have demonstrated flexibility in application of the tracing rules. As such, this is an area where it is likely that the forensic accountant will work closely with counsel, with a clear division establishing itself: the forensic accountant focusing on the messy and complex business of analysing financial, corporate and banking records to follow the money; legal counsel considering the appropriate rules to apply.


Tracing the assets, however, is only the start. Arguably the most important aspect is recovery; in this regard the value of the assets is crucial – this must be weighed up against the costs of physical recovery and realisation where appropriate. The value of any underlying asset is often surrounded by uncertainty, particularly in cases where funds have been secured from third parties based upon spurious asset values: these assets consist of properties, businesses, shareholdings or entities that can be located in far-flung countries; consequently, they can prove to be extremely difficult to value. Once again, the sophisticated forensic accountant will be able to turn to specialists in his or her team who will be experienced in undertaking valuations of these assets with their associated complications.

In the case of both conventional assets and those of a more unusual nature, it needs to be established that it makes sense economically to pursue recovery. Once this appears to be the case, the method of doing so should be determined. There are a number of approaches that can be used to recover assets: the most usual route is by way of conventional litigation, albeit that this is often complicated by the need to litigate in a number of countries and different legal systems. The role of the forensic accountant then shifts to providing litigation support, feeding into various particulars of claim and witness statements, etc.

A less common, albeit potentially effective, route is to use the formal powers of insolvency practitioners to take control and ultimately realise the assets. Most insolvency practitioners in the UK are accountants or insolvency experts working in firms of accountants. Upon formal appointment, an insolvency practitioner takes on certain powers and responsibilities that can prove particularly helpful in gaining control of assets that would otherwise require an unwieldy and ultimately costly legal process to achieve the same end result. It is helpful that many of the offshore jurisdictions where control of such assets ultimately rests adopt the English legal system or variations thereof. The insolvency practitioner, once appointed, is able to utilise his or her powers, often across borders, to control assets and ultimately realise them for the benefit of creditors (which, where there is fraud or misappropriation of assets, will likely include the victim).

In respect of insolvent entities, potential recoverable assets could be unconventional in their nature. For example, there may be outstanding litigation against certain parties or, indeed, claims that arise as a consequence of the insolvency itself. This may include such matters as professional negligence claims against advisers. This would likely involve the skills and expertise of a forensic accountant, this time not from a pure investigative capacity but as an adviser on quantum. The forensic accountant would assist the insolvency practitioner (and his or her legal advisers) in quantifying the losses suffered and assisting with formulating the damages claim. The forensic accountant or (with independence in mind) another forensic accountant may ultimately be required to act as an expert under Civil Procedure Rule No. 35 or its equivalent in overseas jurisdictions should the matter proceed to litigation.


1 Stephen Peters is a partner and Natalie Butcher is a director at BDO LLP.

2 IBM's Marketing Cloud.

3 Foskett v. McKeown [2001].