Skip to main content

Lesson 03 of 25

Accounting Concepts Every Examiner Must Know

5 min read · CFE

Build just enough accounting fluency to read a fraud in the books: the accounting equation, double-entry, the three financial statements, and accrual versus cash. See exactly where each concept gets manipulated and how to spot it.

Why an examiner needs accounting

  • Most occupational fraud hides in the books
  • You can't spot a falsified entry you can't read
  • Goal: enough fluency to follow the money on paper

Before we tour the schemes, we need a shared accounting foundation, because most occupational fraud is ultimately hidden in the books. Someone has to make the missing money disappear from the records, and that leaves a trace if you know how to read it. You don't need to be a C-P-A for this exam, but you do need fluency: you should be able to follow a transaction through the records and notice when something doesn't balance or doesn't make sense.

Here's the way to think about it. Every dollar a fraudster steals creates a problem somewhere else in the system, because the records have to keep telling a consistent story. Your job as an examiner is to spot the spot where the story stops being consistent.

That's why we start here rather than with the schemes. If you can read an entry, you can recognize a fake one, and almost everything in the rest of this course builds on that skill. This lecture gives you that.

We'll keep it concrete and tie every concept back to how fraud distorts it, so you're not memorizing accounting for its own sake — you're learning exactly the slice an examiner uses.

The accounting equation and double entry

  • Assets = Liabilities + Owners' Equity
  • Every transaction has two sides — debits equal credits
  • Fraud must balance the equation too — that's the trail

Start with the equation that governs everything: assets equal liabilities plus owners' equity. The books must always balance to that identity. That's enforced by double-entry bookkeeping, where every transaction touches at least two accounts, and total debits equal total credits.

Debits and credits aren't good or bad — they're just the two sides of every entry, and they always have to match. Here's the key insight for a fraud examiner: a thief can't just remove an asset and walk away, because that would leave the equation out of balance and the books wouldn't foot. They have to make a second entry to hide the hole — a fake expense, a phony write-off, a bogus credit memo, a charge to an account no one scrutinizes.

That balancing entry is the fraud's fingerprint, and tracing it is often how a scheme is unraveled. So when the exam describes someone stealing an asset, train yourself to ask the next question automatically: what was the offsetting entry, and is it real? The answer to that question is usually where the fraud is exposed, because the cover-up entry has to land in some account, and that account is the loose thread you pull.

The three financial statements

  • Balance sheet — assets, liabilities, equity at a point in time
  • Income statement — revenue and expenses over a period
  • Statement of cash flows — where the cash really moved

There are three statements you must know, and the exam expects you to know what each one is for. The balance sheet is a snapshot at one moment in time: what the company owns, what it owes, and what's left over for the owners. It's the equation we just covered, frozen on a given date.

The income statement, also called the profit and loss statement, covers a span of time — a quarter, a year — and shows revenue minus expenses to arrive at net income. And the statement of cash flows tracks the actual movement of cash in and out of the business over that same period, which matters enormously because profit on paper and cash in the bank are not the same thing. Hold onto that idea, because it's the single most useful one in this whole branch.

A favorite financial-statement fraud is to report glowing income while cash quietly drains away — and the cash-flow statement is where that lie often shows, because you can fake an accounting entry far more easily than you can fake a bank balance. When earnings keep climbing but cash from operations doesn't follow, an examiner gets suspicious, and the exam wants you to have the same reflex.

Accrual vs. cash basis

  • Accrual — record revenue when earned, expense when incurred
  • Cash — record only when money moves
  • GAAP uses accrual; the timing gap is a fraud opportunity

Now a distinction the exam loves: accrual versus cash basis. Under accrual accounting, which Generally Accepted Accounting Principles require for most entities, you record revenue when it's earned and expenses when they're incurred, regardless of when cash changes hands. Under cash basis, you record only when money actually moves.

That timing gap in accrual accounting is exactly where a lot of financial-statement fraud lives. Booking revenue before it's truly earned, or pushing expenses into next period, both exploit the judgment calls that accrual accounting requires. When you see a scheme built on when something was recognized, you're looking at a timing fraud.

Red flags in the numbers

  • Ratios drifting out of line with peers or history
  • Revenue up but cash flow down
  • Round numbers, top-side journal entries, period-end spikes

Finally, the patterns that make an examiner's antennae twitch. Watch the ratios — gross margin, receivables turnover, days sales outstanding — and compare them to the company's own history and to peers; a sudden, unexplained drift is a flag. Watch for revenue rising while operating cash flow falls, the classic sign that reported sales aren't turning into real money.

And watch the entries themselves: suspicious round numbers, large top-side journal entries made by management after the books close, and transactions clustered right at period-end to hit a target. None of these prove fraud on their own. They tell you where to look, which is the whole game — you're building a map of where to dig, not a verdict.

On the exam, when a question hands you a list of indicators and asks what they suggest, resist the urge to declare guilt; the right answer is almost always that they warrant further investigation. Next, we put this to work on the most common branch — asset misappropriation, starting with how cash is stolen on the way in.

Sources

  • Generally Accepted Accounting Principles (GAAP) — accrual basis and the accounting equation
  • the three primary financial statements
  • double-entry bookkeeping

Test your knowledge

A few CFE questions on this material — pick an answer to see the explanation.

  1. Q1. In structuring an admission-seeking interview, a fraud examiner should generally:

  2. Q2. An examiner reconstructs a subject's income indirectly by comparing the subject's net worth at the start and end of a period plus living expenses, against known income. This indirect method is the:

  3. Q3. When writing a fraud examination report, the examiner should:

  4. Q4. When collecting digital evidence from a computer, the primary reason an examiner works from a forensic image (bit-stream copy) rather than the original drive is to:

Ready to practice?

Put this lesson to work on real CFE questions.

Drill the full CFE bank →