Forensic Accounting and Evidence Preservation in QuickBooks

Overview

By the time a client calls you about suspected fraud, the clock is already running: records can be altered, evidence can vanish, and every day of delay weakens your case. If your practice touches QuickBooks Online, you need to know how to move fast and correctly. This course walks you through exactly that, from scoping the engagement and preserving the file before anything changes, to gaining access when someone tries to block you. You’ll master the Audit Log to recover deleted and voided transactions, examine reconciliation history and bank feeds for tampering, and use Reclass to isolate suspicious activity - the same techniques a trained investigator relies on. You’ll also learn to cross-match vendors and employees for shell-vendor and ghost-employee schemes, trace lapping on the revenue side, and spot the AP red flags that confirm what you suspected all along

This event may be a rebroadcast of a live event and the instructor will be available to answer your questions during the event.

Objectives

After attending this presentation, you will be able to...

• Execute Evidence Preservation Protocols: Explain the necessity of prioritizing evidence preservation and demonstrate how to export a defensible, unalterable QBO snapshot before ledger data is modified.
• Navigate Access & Authorization Risks: Identify administrative access liabilities, manage uncooperative gatekeepers, and establish secure investigation workflows without sharing credentials.
• Audit Ledger Modifications: Utilize the QBO Audit Log and historical reconciliation data to precisely track deleted or voided entries, identifying who modified specific data and when.
• Conduct Forensic Financial Analysis: Apply comparative financial statement tracking (P&L and Balance Sheet) and general ledger drill-down workflows to isolate unusual activity patterns and transaction anomalies.
• Detect Exploits Across Accounting Cycles: Recognize critical QBO fraud red flags, including payroll padding, shell vendors, ghost employees, lapping schemes, and manipulative bad debt write-offs.
• Implement Safe Scenario Testing: Set up and execute clearly marked test entries and tracking parameters to run forensic scenarios without corrupting native client records.
• Adhere to Regulatory Standards: Describe the compliance boundaries set by AICPA Statement on Standards for Forensic Services No. 1 (SSFS No. 1) and the ACFE Code of Professional Standards, specifically regarding the limitations on concluding legal fraud.

Highlights

The major topics that will be covered in this course include:

• Evidence Preservation & Cryptographic Security: Prioritizing immediate data protection by exporting defensible QuickBooks Online (QBO) snapshots and utilizing Windows PowerShell or Command Prompt to generate file hashes to prove data integrity.
• Standards Compliance & Access Management: Navigating the legal and professional boundaries of AICPA SSFS No. 1 and ACFE standards, which prohibit CPAs and CFEs from making final legal conclusions of fraud, while managing administrative access levels and uncooperative gatekeepers.
• Ledger Auditing & Transaction Reconstruction: Using the QBO Audit Log to uncover deleted or voided entries, performing reconciliation health checks, auditing bank feed gaps, and examining Undeposited Funds and journal entries to trace hidden or manipulated cash.
• Analytical Procedures & Metadata Analysis: Applying comparative horizontal and vertical financial statement analysis, drilling down into General Ledger transaction details, and evaluating created-date metadata to flag anomalies like weekend or after-hours entries.
• Targeted Fraud Detection & Testing: Cross-matching vendor and payroll records to expose shell vendors or ghost employees, analyzing accounts receivable write-offs for lapping schemes, and applying safe, isolated scenario-testing techniques within QBO

Designed For

CPAs who use Quickbooks, fraud examiners, forensic accountants, bookkeepers

Prerequisites

None

Preparation

None

Notice

You will receive an email from CPA Crossings via Webex with instructions to access the webinar.