Forensic Accounting: Investigating Red Flags

1. Establish a reliable evidence base

1.1 Reports, versions and audit language

Collect the annual report, complete notes, auditor’s report and relevant subsequent corrections directly from issuer or exchange records. Record publication date, reporting period, currency units, consolidation basis and restatements. Comparing a consolidated group with last year’s standalone company can manufacture a trend. A change from thousands to millions can destroy an otherwise accurate spreadsheet. Keep source page references beside each extracted number so another analyst can reproduce the calculation.

1.2 Comparable periods and accounting policies

Read the audit opinion and the basis for any modification; also distinguish an emphasis of matter and key audit matters from a qualified opinion. An unmodified opinion is valuable evidence within its scope, not a guarantee that every risk or future failure is absent. Check changes in estimates, policies and business structure before interpreting ratios. Build a short chronology of acquisitions, disposals and reporting changes. The strongest first question is often whether the numbers are comparable at all.

Step-by-step method

1. Save dated source reports and audit wording.
2. Standardise units, reporting basis and restated comparatives.
3. Link every spreadsheet input to its report note or page.

2. Reconcile profit with cash and working capital

2.1 Accruals and conversion

Accrual accounting recognises activity when the relevant criteria are met, not only when cash moves. Begin with the reported reconciliation from profit to operating cash. Non-cash depreciation, changes in receivables, inventory and payables, and classification choices can explain differences. A transparent screening measure is (net income−cash from operations)/average total assets, with matching scope and period. State this exact definition rather than calling it the only accrual measure. Compare several years and suitable peers.

2.2 Receivables and inventory quality

Investigate receivables growing faster than sales, overdue balances, allowances and concentration in customers. Receivable days can be approximated as average trade receivables divided by annual credit sales times365; using total sales is a disclosed proxy where credit sales are unavailable. Check inventory ageing, write-down policy and whether payables temporarily finance cash conversion. Positive cash generated by delaying suppliers is different from cash collected from profitable customers. Seasonality and expansion can explain warning signals, so seek corroborating notes.

Step-by-step method

1. Build a profit-to-cash bridge with consistent classifications.
2. Calculate working-capital ratios and identify data proxies.
3. Compare ageing, provisions and subsequent collection evidence.

3. Trace revenue quality and balance-sheet obligations

3.1 Recognition, estimates and reversals

Read how revenue is recognised for the business model, including delivery, performance obligations, returns and variable consideration where relevant. Examine unusual year-end growth, contract assets, customer advances and subsequent reversals. These are inquiry points, not a checklist that proves wrongdoing. Changes in useful lives, capitalisation policy or impairment estimates can also affect profit. Distinguish a legitimate estimate update with evidence from a pattern that requires further explanation.

3.2 Commitments beyond the headline debt figure

Headline borrowings do not describe every cash obligation. Review lease liabilities, guarantees, contingent liabilities, pledged assets, purchase commitments and financing arrangements in the notes. Some items are recognised on the balance sheet; others are disclosed contingencies or commitments under the applicable framework. Avoid calling every note item “hidden debt.” Map the possible cash event, amount, timing and condition. This produces a better liquidity assessment than adding every contingent amount as if it were an immediate certain payment.

Step-by-step method

1. Map the revenue policy to actual operating transactions.
2. Review estimate changes and unusual closing-period balances.
3. Create a recognised-debt and conditional-obligation schedule separately.

4. Investigate related parties and governance

4.1 Relationship is not proof of abuse

Identify controlling parties, subsidiaries, associates, key management and other relevant relationships from the reporting framework and company disclosures. Then follow transactions, outstanding balances, commitments and settlement terms. Ask what business purpose the transaction serves, whether pricing and repayment terms are explained, what approvals apply and whether recoverability is supported. A family-controlled structure does not itself prove misconduct; nor does disclosure automatically make every transaction economically fair.

4.2 Follow the economics and approvals

Create a counterparty map linking sales, purchases, loans, guarantees and receivables. Reconcile opening balances plus new activity minus settlement to closing balances where the data permit. Unexplained differences become questions for further evidence. Compare the listed entity’s benefit with the risks and resources committed. Record management explanations separately from independently supported facts. If authoritative enforcement findings exist, identify their date and procedural status; allegations, investigations and final findings are different categories.

Step-by-step method

1. Map relationships and each material transaction type.
2. Check economic rationale, terms, approval and recoverability.
3. Separate documented facts, explanations and unresolved questions.

5. Use statistical screening as triage

5.1 What the Beneish framework observes

The eight-variable Beneish framework combines indices for receivables relative to sales, gross margin, asset quality, sales growth, depreciation, selling and administrative expense intensity, leverage and accruals. Its coefficients and classification thresholds belong to a specified research model. Reproduce the exact version and input definitions from the original study before computing it. Do not mix a cash-flow accrual proxy with another version’s coefficient without disclosure. Missing or zero denominators can make an index undefined.

5.2 From signal to defensible conclusion

A higher screening concern does not identify intent or prove misstatement, and calibration from one historical sample may not transfer to PSX industries or financial institutions. Use the result to prioritise note review and sensitivity analysis, not as an automatic sell instruction. Finish with an evidence matrix: signal, plausible benign explanation, contradictory evidence and next verification. Consider position sizing or abstaining while uncertainty remains. A defensible conclusion states what the public evidence supports and what cannot be established without further access.

Step-by-step method

1. Verify the model version and whether the company is suitable for it.
2. Reconcile all inputs and flag undefined ratios rather than forcing numbers.
3. Combine the signal with documentary evidence and uncertainty.

Profit and cash differ for reasons to investigate

Reference table

Glossary of key terms

Accrual

Recognition of economic activity before or apart from its cash settlement.

Audit modification

A change from an unmodified opinion for reasons stated by the auditor.

Contingent liability

A possible or qualifying obligation assessed under the applicable accounting rules.

Contract asset

A right linked to performance whose collection is subject to conditions beyond only passage of time.

M-Score

A specified statistical earnings-manipulation screening model.

Related party

A person or entity linked in ways defined by the reporting framework.

Restatement

Revision of previously reported financial information under applicable rules.

Working capital

Operating current-asset and liability balances under a stated definition.

Frequently asked questions

Common pitfalls