2.1 Accounting & financial-statement concepts refresher

Why fraud examiners need accounting

Fraud is almost always committed through, and concealed within, an organization's books and records. A Certified Fraud Examiner who cannot read a general ledger, trace a journal entry, or reconcile a bank statement is working blind. This refresher establishes the accounting vocabulary that every asset-misappropriation scheme in this chapter is ultimately built on.

The accounting equation

The foundation of double-entry accounting is the accounting equation:

Assets = Liabilities + Equity

Assets are economic resources the entity controls (cash, receivables, inventory, equipment). Liabilities are obligations owed to outsiders (payables, loans, accrued wages). Equity is the owners' residual interest — what remains after liabilities are subtracted from assets. The equation must always balance: every transaction affects at least two accounts so the two sides stay equal. When a fraudster removes cash (an asset), something else must change to keep the books balanced, and that "something else" is where the concealment happens.

Debits and credits

Every transaction is recorded with equal debits and credits. A debit increases assets and expenses and decreases liabilities, equity, and revenue. A credit does the opposite. In any journal entry, total debits must equal total credits. A simple cash sale is:

• Debit Cash $500 (an asset increases)
• Credit Sales Revenue $500 (revenue increases)

To conceal a theft, a fraudster must post an offsetting entry. If an employee steals $500 of already-recorded cash, the ledger still shows the receivable or the revenue, so the general ledger will not reconcile to the bank unless the thief writes off an account, records a fake expense, or debits an asset such as inventory shrinkage. Knowing what the honest entry should look like is what lets the examiner spot the dishonest one.

The four financial statements

Fraud examiners work with four primary statements:

The balance sheet is a snapshot at one instant; the income statement, cash-flow statement, and equity statement all cover a span of time. Asset-misappropriation schemes usually surface first on the income statement (as missing revenue or an inflated expense) even though cash — a balance-sheet asset — is what was actually stolen.

Accrual vs. cash basis

Under the cash basis, revenue and expenses are recorded only when cash changes hands. Under the accrual basis (required by GAAP), revenue is recognized when earned and expenses when incurred, regardless of cash timing. Accrual accounting creates receivables, payables, and accruals — the very accounts fraudsters exploit. Lapping of receivables, covered later in this chapter, only works because accrual accounting tracks the amount each customer owes over time.

How fraud hides in the books

Concealment falls into predictable patterns:

• Off-book schemes never enter the accounting system at all. Skimmed cash is stolen before any entry is made, so no ledger account is out of balance — this is why skimming is so hard to detect.
• On-book schemes leave a trail. Cash larceny, fraudulent disbursements, and register schemes all require an entry to be made, altered, or reversed, giving the examiner a document to follow.
• Forced balancing occurs when a thief manipulates a reconciliation — for example, falsely writing off a receivable or inflating a cost account — so the general ledger still ties to the bank despite the missing money.

From ledger to trial balance

Transactions first post to the general ledger, a master record of every account, while detailed subsidiary ledgers track individual customers (accounts receivable) and vendors (accounts payable). The sum of a subsidiary ledger must equal its control account in the general ledger; a mismatch between the two is a classic fraud red flag. Periodically the account balances are listed in a trial balance to confirm that total debits equal total credits before the financial statements are prepared. Because the four statements articulate — net income flows into retained earnings within equity, and the statement of cash flows reconciles reported profit to the actual change in the cash balance — a fraudster who alters one figure must ripple that change through several accounts. Each additional account touched multiplies the chance of leaving an inconsistency the examiner can find.

The audit trail the examiner follows

The audit trail links source documents to the books: sales invoices, purchase orders, receiving reports, checks, deposit slips, and bank statements all feed journal entries that post to the general ledger and roll up into the financial statements. A fraud examiner reconstructs this trail in reverse, starting from the statements and drilling down to the source document that proves — or disproves — that a transaction ever occurred.

These fundamentals let the examiner ask the right questions. Does recorded revenue match bank deposits? Do expenses have legitimate supporting documents? Does the sum of the subsidiary ledgers equal the control account? Every asset-misappropriation scheme in the sections that follow is, at bottom, a distortion of the accounting equation, and detecting it means knowing exactly what the honest books should have shown.