Financial statement fraud does not appear out of nowhere. It gets recorded, one entry at a time, in the same ledgers that hold every legitimate transaction. That is the opening a forensic accountant works with. If someone overstated assets or invented revenue, the false numbers had to enter the books through journal entries, and journal entries leave a trail.
A journal entry is the basic record of a transaction. It captures the date, the amounts, the accounts affected with their numbers, and a short description of what happened. Entries flow from the journals into the general ledger, and the ledger becomes the raw material for the financial statements. Because everything routes through this layer, it is where a careful review can catch what a glance at the finished statements never would.
Benford's Law and the shape of real numbers
One tool forensic accountants use is Benford's Law. It describes the expected frequency of leading digits in large sets of naturally occurring numbers. Genuine accounting data tends to follow that distribution closely. Fabricated data usually does not, because people inventing figures do not produce the same spread that real activity does. When the first digits of a batch of journal entries drift far from what Benford's Law predicts, or when the same dollar amount repeats far more often than chance allows, that is a signal worth chasing.
A lesson from HealthSouth
The HealthSouth fraud shows why this matters. Staff there knew that entries above a certain dollar threshold got extra scrutiny, so they recorded large numbers of false entries just below the review line. Each one looked small enough to ignore. Testing the leading digits of those entries would have exposed the pattern, because a wall of amounts clustered just under a round threshold is not what honest bookkeeping produces. The overstatement of assets and income ran for years before it came out.
A wall of amounts clustered just under a review threshold is not what honest bookkeeping produces.
Testing the entries that matter
Running statistics on every entry is not the goal. A risk-based approach puts attention where fraud is most likely to hide. Guidance such as AICPA Practice Alert 2003-02 points to the entries that deserve a hard look: ones posted to unrelated or seldom-used accounts, entries made by someone who does not normally touch the journal, round numbers recorded at the very end of a period, and post-closing adjustments with no real explanation or account number attached.
The method behind it is old-fashioned. Who made the entry, what it touched, when it was posted, where it landed, and why. An honest entry answers those questions easily. A fraudulent one tends to fall apart on the second or third.
How well any of this works depends on what the accounting system can give you. A clean export with user IDs, timestamps, and descriptions makes the analysis fast. Missing fields, shared logins, or entries with no author attached slow it down and are sometimes a warning in their own right, since a system where anyone can post anything under anyone's name is a system built for exactly this kind of trouble.
None of this replaces judgment. The tests point to entries worth examining. A person still has to open them up and decide whether there is an innocent explanation. But knowing where to point that judgment is most of the work, and the journal is almost always where it starts.
Seeing red flags like these in your own numbers?
A confidential consultation costs nothing and tells you where you stand.
What it means for your matter
Most engagements are not Enron. But the pattern is the same at every scale: a diverted vendor payment, a related party that shouldn't exist, revenue booked before it was earned, a reserve fund that never quite reconciles. The methods used to expose a multibillion-dollar fraud are the same methods that expose a bookkeeper skimming from a small business or a managing agent taking kickbacks from a co-op.
If something in your financial picture doesn't add up, the earlier a forensic accountant looks, the more of the trail survives. Documents get lost, memories fade, and money moves. The record is easiest to reconstruct while it is still fresh.
Think something's wrong with your numbers?
Talk to a forensic accountant. It's confidential, and there's no obligation.