Forensic accounting services and consultants: how to choose, and where software fits

Professional forensic accounting services become necessary when a dispute or financial investigation demands rigorous analysis that an expert can formalize and defend during legal proceedings. Conversely, specialized software serves as the ideal solution when high transaction volumes require immediate automated detection and documentation of red flags before a case is formally opened.

Forensic accounting involves applying investigative techniques and financial controls to corporate disputes or suspected misconduct, generating evidence suitable for court proceedings and regulatory reviews. Labrynth develops dedicated software solutions in this domain alongside industry resources, positioning its platform as one of several available approaches. Details concerning Labrynth technology stem from official product specifications published on its anti-fraud resources as of October 27, 2026.

Investigation and litigation work

Under the AICPA's Statement on Standards for Forensic Services No. 1 (SSFS No. 1), engagements are either litigation or investigation. Litigation means a real or possible proceeding before a trier of fact or a regulatory body, where the member acts as an expert witness or consultant, or as a neutral such as a mediator or arbitrator; the standard stretches the term to cover alternative dispute resolution. Investigation means work done in response to specific concerns of wrongdoing, where the member examines evidential matter so that stakeholders such as the client or a regulator can judge whether the concerns have merit. The standard took effect for engagements accepted on or after January 1, 2020.

What decides whether it applies is why the member was engaged, not which skills were used. In the standard's own example, the same data analysis can fall outside it in one engagement and inside it in another, so work an AICPA member sells as forensic accounting consulting is covered when its purpose is litigation or investigation.

The pages of UHY and CRA, both forensic accounting companies, describe their work in sales language. On October 27, 2026, UHY listed fraud investigations covering asset misappropriation and fraudulent financial reporting, plus expert testimony in trial cases. CRA's page says its team supports disputes and investigations. It names bribery and corruption alongside financial statement irregularities.

Occupational Fraud 2026: A Report to the Nations, published by the Association of Certified Fraud Examiners (ACFE), is a global study. Its 14th edition analyzes 2,402 cases from 143 countries and territories, so its figures are not specific to the United States. Each responding Certified Fraud Examiner described the single largest occupational fraud case investigated between January 2024 and September 2025.

In the 2026 ACFE report, asset misappropriation appeared in 90% of the cases with a median loss of USD 100,000, and corruption in 45% with USD 150,000. Financial statement fraud appeared in 6%; for that category the ACFE records the gross amount of the misstatement, USD 1,000,000 at the median, because direct losses are spread among many stakeholders and are hard to estimate. The sample describes investigated occupational fraud, not financial crime as a whole.

The standards and credentials behind the title

Buyers learn little from a business card that says forensic accountant. The standard the work follows and the credentials of the people doing it say more.

• SSFS No. 1 binds AICPA members, and employees of member firms, who provide services to a client in a litigation or investigation engagement. It leaves out work an employer assigns to an employee member who is not in public practice, so a CPA doing the same analysis on staff sits outside it. Inside its scope, a member serves the client with integrity and objectivity, agrees the scope and limits of the work with the client, and tells the client about conflicts.
• The Certified in Financial Forensics (CFF) credential is, per the AICPA page read on October 27, 2026, open to AICPA members who are CPAs. On its standard pathway it asks for at least 1,000 hours of forensic accounting experience in the five years before applying and 75 hours of related continuing education, or the AICPA's CFF Learning Pathway. Applicants then pass a 175-question multiple-choice exam, and holders recertify every year.
• The ACFE awards its Certified Fraud Examiner (CFE) credential to members who reach 50 eligibility points (40 are enough to sit the exam), have two years of professional experience in a field related to detecting or deterring fraud, and pass an exam in three areas of the fraud examination body of knowledge. Holders agree to the ACFE Code of Professional Ethics.

Separately, the ACFE Code of Professional Standards binds certified members wherever they work, while associate members should strive to follow it but are not bound by it. A CFE on an organization's staff is therefore held to the Code even where SSFS No. 1 does not reach.

Each credential answers a different question. A CFF holder is a CPA with documented forensic accounting experience. A CFE can come from accounting and compliance as well as from security and law, so a CFE may or may not be a CPA. The published requirements for neither credential mention testimony or industry experience; references and past matters have to show that.

What starts an engagement, and why timing matters

SSFS No. 1 defines where an engagement starts: with specific concerns of wrongdoing for an investigation, and with a real or possible proceeding before a trier of fact for litigation. The AICPA lists bankruptcy and family law support among the specialties its CFF credential covers. In the global sample of the 2026 ACFE report, tips were the most common detection method, accounting for 43% of frauds, and employees supplied 55% of the tips.

Objectivity and conflicts of interest get attention in both documents. SSFS No. 1 describes objectivity as being impartial and free of conflicts of interest, and it requires the member to inform the client of conflicts that may occur. Before accepting a fraud examination, the ACFE Code requires a CFE to investigate for actual, potential and perceived conflicts of interest and to disclose them.

Delay has a measurable price in the 2026 ACFE report, whose sample is global. Median time to detection was 12 months across the cases. Frauds caught within six months had a median loss of USD 40,000, and a further delay of one to six months pushed the median past double, to USD 100,000.

Scope and fees: what the standards fix and what they leave open

SSFS No. 1 accepts a written or oral understanding with the client on the scope and limitations of the services and asks the member to modify it when circumstances require a significant change. The ACFE Code goes further on timing: at the beginning of a fraud examination, a CFE reaches an understanding with whoever retained them about scope and limitations and about each party's responsibilities, and a new one if those change significantly. The Code also sets predication and scope priorities at the outset, to be revisited as the work proceeds.

Fee levels are not published in the standards or the ACFE Code, or on the vendor pages cited here, so none is given. SSFS No. 1 tells a member whose assignment turns into a litigation or investigation engagement to modify the understanding with the client. A buyer can use that structure by asking for a first phase that tests what the records support, then deciding how far to go.

Questions to put to a firm or consultant before signing

These questions draw on the ACFE Code and SSFS No. 1, except those on testimony history and analytics software, which are this guide's own. They apply to forensic accounting consulting firms and independent consultants alike. Put them in writing:

1. Who will do the work, which credentials do they hold, and how much of the matter will the senior people handle themselves?
2. What conflicts check was run before acceptance, and what will the firm tell you if a conflict arises during the work?
3. How will evidence be collected and stored, and who will have access to it?
4. Which methods will be used to test the records, and what happens when the records cannot support a conclusion?
5. What will the deliverable look like, and what will it decline to say?
6. Has the firm testified, and would the person who did the analysis be the person on the stand?
7. How is a change in scope handled, and is any part of the fee tied to the outcome?
8. Which analytics software does the team use, and who checks its output before it reaches a report?

Evidence handling and chain of custody

Examiners are asked by the ACFE Code to set up effective control and management procedures for documents and data, to stay aware of the chain of custody (origin, possession and disposition), and to preserve the integrity of the material. It also tells them to weigh exculpatory evidence as well as inculpatory, and to stay alert to conjecture and bias in witnesses. The Code leaves the extent of documentation to the needs and objectives of the client or employer, so the level of detail is something to agree at the start; a sample evidence log from a past matter, with names removed, is a concrete way to see how a firm documents its work.

Reports and testimony

Per the ACFE Code, a fraud examination report may be oral or written, no single format is prescribed, and the report should not mislead. It must rest on evidence that is sufficient, reliable and relevant, stay within the examiner's area of knowledge, and express no opinion on the legal guilt or innocence of any person or party. SSFS No. 1 sets a related limit on opinions about fraud for AICPA members.

For testimony in federal court, Rule 702 of the Federal Rules of Evidence, as amended effective December 1, 2023, requires the party offering an expert to show it is more likely than not that the expert's specialized knowledge will help the trier of fact, the testimony rests on sufficient facts or data, it comes from reliable principles and methods, and the opinion reflects a reliable application of those methods to the case. That test applies to the testimony itself, so the facts, data and method behind a report have to stand up as well as the report.

Where software fits in a forensic workflow, and where it stops

Proactive data monitoring and analysis was one of the 18 anti-fraud controls the ACFE measured, and it was in place at 49% of the victim organizations in the global 2026 sample. Median loss there was USD 70,000 against USD 150,000 where it was absent, and median duration was 9 months against 16. The report words these as associations. Organizations that run analytics may differ from the rest in other respects too. These are ACFE survey figures and say nothing about Labrynth or any other vendor.

Labrynth's anti-fraud page describes software that detects suspicious claims and transactions, connects patterns across entities and networks, and turns high-risk activity into traceable, investigation-ready evidence. Detection runs in three layers on that page: record-level checks for anomalies, entity risk analysis across related providers and vendors, and network analysis of shared addresses and locations. One step of the workflow builds an evidence trail of source records and analyst decisions, and the page presents the product as a layer over existing claims and payment systems and case tools.

That page also sets limits on what the product does. It says the workflow can flag suspicious activity for review instead of automatically blocking it, that fraud rings can be detected where the necessary relationship data is available, and that the product is not primarily designed to detect forged IDs or manipulated documents. Human investigators and authorized decision-makers retain judgment, escalation, remediation and enforcement responsibility, according to the page, and it names no expert reports or testimony among its outputs.

This guide adds a caution of its own: software supports investigators and is not a substitute for licensed professionals, legal counsel or auditors, and final decisions on a case stay with qualified people. Outside firms use software as well: CRA's forensic accounting page says its risk-based transaction testing and targeted analysis are supported by advanced analytics and AI-enabled tools.

In-house, outside firm or software-assisted

Routes can overlap or hand over. A firm may use analytics, as CRA's page says, and SSFS No. 1 anticipates an assignment that begins under other standards and becomes a litigation or investigation engagement, in which case the member revisits the understanding with the client.

Choosing by situation

A suspected scheme inside one organization matches the SSFS description of an investigation: specific concerns of wrongdoing and a stakeholder who must decide whether they have merit. A member engaged by a client for that purpose falls under SSFS No. 1, and a CFE under the ACFE Code.

When a dispute needs a figure the other side will challenge, it is a litigation matter, and the Rule 702 test applies in federal court to whoever offers the testimony. Qualifications, the data behind the opinion and the method used are what that test examines.

Large volumes of claims or payments with no clear way to choose which to review match the use cases on the anti-fraud page: public benefits and healthcare payment integrity, along with provider fraud and improper payments, along with fraud rings. That page invites teams to book a demo built around their own program data, bringing known fraud patterns and the investigation process to the session.

Frequently asked questions

What do forensic accounting services include?

They include investigation of suspected wrongdoing and support in disputes, as SSFS No. 1 frames the work, and some firms add help with internal controls: UHY lists forensic financial analyses to assess internal controls alongside its fraud investigations. CRA separately lists digital forensics among its services.

How much does forensic accounting cost?

Amounts depend on the engagement, but documented rules shape how fees may be arranged. A member acting as an expert witness under SSFS No. 1 may not give opinions under a contingent fee unless the AICPA's contingent fee rule explicitly allows it, and the work is bounded by an understanding on scope that is revisited when scope changes materially.

Which standards bind a forensic accountant?

It depends on credentials and role. SSFS No. 1 binds AICPA members and employees of member firms in litigation or investigation engagements for a client, for engagements accepted on or after January 1, 2020. The ACFE Code of Professional Standards binds certified members wherever they work. Anyone offered as an expert in federal court also meets the Rule 702 test.

Can a forensic accountant say that fraud occurred?

Not as an ultimate conclusion, when the member is bound by SSFS No. 1. The standard says a trier of fact decides whether fraud occurred, so a member performing forensic services may not give an opinion on the ultimate conclusion of fraud unless the member is the trier of fact. A member may still offer an expert opinion on whether evidence is consistent with certain elements of fraud. The ACFE Code separately bars CFEs from opining on legal guilt or innocence.

What happens after software flags a case?

On Labrynth's anti-fraud page, a flagged case goes into an investigator-ready case view with linked records and related entities. The page lists review, approval, rejection, escalation, remediation, recovery or another configured downstream action as the next step, and it says the workflow preserves source records and analyst actions so the investigation can be audited and defended.