Forensics

Following the money: how forensic accounting turns suspicion into admissible evidence.

28 Apr 2026·5 min read·Eng. Khaled Alhourani

A board usually arrives with a feeling, not a finding: numbers that do not reconcile, a vendor that is too convenient, a margin that moved without a reason. The gap between that feeling and something a regulator or arbitrator will act on is where forensic accounting earns its name.

From anomaly to evidence

The discipline is in the order of operations. We start by preserving the record — financial systems, communications, and the metadata around both — before anyone who might be involved knows a review is under way. Only then do we test the anomaly. A number that looks wrong in a management report often has an innocent explanation two layers down; the work is to find it or rule it out, not to assume.

Built to be challenged

Evidence that cannot survive cross-examination is not evidence. Every conclusion in our reports traces back to a source document, and every inference is stated as an inference. That discipline is slower up front and decisive later: the report becomes the document the matter turns on, rather than one more exhibit the other side picks apart.

What recovery requires

Finding the money is half the work; making the finding usable is the other half. We build the chain so that the same analysis supports a board decision, a regulator's questions, and, if it comes to it, a tribunal — without being rebuilt three times. Suspicion is cheap. A defensible finding is what changes outcomes.

All insights