Skip to main content

Lesson 21 of 25

Tracing Illicit Transactions and Report Writing

5 min read · CFE

Choose the right proof method — the direct (transaction) method when records exist, the indirect (net-worth) method when they don't — and write a report that states facts without opining on legal guilt. Support recovery and stay objective.

Following the money

  • Tracing proves the fraud and supports recovery
  • Two proof methods: direct and indirect
  • Money leaves a trail — your job is to reconstruct it

Two skills close out the Investigation section: tracing the money and writing the report. Tracing matters because following the funds does three things at once — it proves the scheme actually happened, it identifies where the stolen assets ended up, and it supports recovery, which is the part the victim cares about most: getting the money back. There are two recognized methods of proving illicit income, and the exam wants you to know not just their names but when each one applies, because choosing the right method for the facts is itself a tested skill.

One method works directly from the transactions you can document; the other backs into hidden income from a person's overall financial picture when the documents aren't there. We'll take both in turn, draw the contrast the exam loves to test, and then turn to communicating clearly what you found in the report that ties the whole examination together.

The direct (transaction) method

  • Trace specific transactions, document by document
  • Works when you have the records — invoices, checks, transfers
  • Builds a clear, transaction-level money trail

The direct method, also called the transaction method, traces specific identifiable transactions through the records — this check paid that vendor, those funds moved to this account, then to that asset. It's the method of choice when you have the documentary trail: invoices, cancelled checks, bank statements, wire records. You literally follow the dollars from source to destination, building a step-by-step chain a judge or jury can see and check.

The direct method is the most persuasive proof available when the records exist, because it shows the money actually moving with precision rather than inferring it from circumstance. So the exam cue is straightforward: when the scenario gives you a paper or electronic trail you can follow transaction by transaction, the direct method is your answer.

The indirect (net worth) method

  • Prove hidden income by the change in net worth
  • Net worth + expenditures − known income = unexplained funds
  • Used when direct records are missing or hidden

When the direct records are missing — because the subject dealt in cash or destroyed the trail — you reach for the indirect, or net-worth, method. The logic: if someone's wealth grows by more than their known legitimate income can explain, the difference is unexplained income that may come from fraud. You establish net worth at the start and end of a period, add in living expenses and expenditures, subtract known legitimate sources, and the leftover is the unexplained increase.

It's the method tax investigators famously used against organized-crime figures who kept no honest books — they couldn't trace every dollar, but they could prove the wealth far outran any lawful income. The exam contrast to hold firmly: the direct, or transaction, method traces specific transactions you can document; the indirect, or net-worth, method proves hidden income circumstantially when those records aren't available because the subject dealt in cash or destroyed the trail. Match the method to the records, and you'll get the question right.

Writing the fraud examination report

  • Accurate, clear, objective, relevant, timely
  • State facts and findings — not conclusions of legal guilt
  • Support every assertion with evidence

Now the report — the deliverable everything else feeds into. A good fraud examination report has a few non-negotiable qualities: it is accurate, clear, objective, relevant, and timely. Write it so a reader who knows nothing about the case can follow what happened, what you did, and what you found.

Accurate means every fact is right and verifiable; clear means a reader can follow it without a translator; objective means you let the evidence speak; relevant means you leave out what doesn't bear on the matter; and timely means it lands while it can still be acted on. The single biggest exam point on report writing: state facts and findings, but do not offer an opinion on the ultimate legal question of guilt or innocence. That determination belongs to a judge or jury, not to the examiner, and crossing that line damages your credibility and can be turned against you.

You report that the evidence shows funds were diverted to an account the subject controlled; you do not write that the subject 'is guilty of embezzlement.' Stick scrupulously to what the evidence supports, and support every single assertion with the specific evidence behind it, so a reader can trace each finding back to its source.

Objectivity, recovery, and exam strategy

  • Stay neutral — avoid bias and inflammatory language
  • Tracing supports restitution, freezing, and clawback
  • On the exam: direct vs. indirect method; no opinion on guilt

Finish with objectivity and outcome. Keep the report neutral — no editorializing, no inflammatory characterizations, no speculation beyond the evidence — because anything that reads as advocacy undermines your credibility and can be used against you on cross-examination. And remember that tracing isn't just proof for its own sake; it enables recovery, supporting restitution orders, asset freezes, and clawbacks that actually make the victim whole.

When you've followed the money to a specific house or bank account, you've handed the lawyers something concrete to seize, which is often the outcome the client wanted from the start. For the exam, lock in two anchors from this lecture: choose the direct method when you can document specific transactions and the indirect net-worth method when records are hidden or destroyed; and never state a conclusion of legal guilt in your report. That closes the Investigation section.

Next, the final section — why people commit fraud and how organizations deter it.

Sources

  • Tracing illicit transactions — direct (transaction) method and indirect (net worth) method of proving illicit income
  • asset recovery principles
  • ACFE report-writing standards (accuracy, clarity, objectivity, timeliness)
  • avoiding opinions on legal guilt in the report

Test your knowledge

A few CFE questions on this material — pick an answer to see the explanation.

  1. Q1. Which branch of the ACFE Fraud Tree includes financial statement fraud, asset misappropriation, and corruption?

  2. Q2. A convenience store cashier rings up a sale at the correct amount, hands the customer change, but then voids the transaction in the register and pockets the cash. This is a:

  3. Q3. An accounts-payable clerk alters the payee name on a company check from a legitimate vendor to her own name. This is best described as:

  4. Q4. A procurement manager discloses a competitor's confidential bid to a preferred vendor, allowing that vendor to submit a slightly lower bid and win the contract. This is an example of:

Ready to practice?

Put this lesson to work on real CFE questions.

Drill the full CFE bank →