A supplier invoice sits in your inbox, but the purchase order doesn't match it. The bank reconciliation looks complete, yet the ledger contains a payment nobody can explain. Perhaps a long-serving employee has booked an unusual holiday just as an approval control failed. You want an answer, but you don't yet know whether you're looking at fraud, an accounting error, a systems problem, or a personal dispute that has spilled into the business.
That hesitation is normal. It can also become expensive. Fraud reached 4.5 million incidents in England and Wales in the year ending March 2026, with a fraud prevalence rate of 7.8%, according to the Office for National Statistics crime figures. The practical question isn't whether fraud exists. It's whether you can preserve evidence and establish what happened before records disappear, money moves, or an allegation becomes a legal liability.
The Moment You Realise Something Is Wrong
The discovery often arrives during routine work. A finance director reviews year-end management accounts and spots a cash movement that doesn't reconcile. A Xero or Sage export shows a supplier payment that bypassed the normal purchase order route. The invoice carries a familiar name, but the bank details differ from the approved record.
Then the explanations begin. Perhaps someone changed the supplier's account after a telephone request. Perhaps the missing ledger entry reflects a timing issue. Perhaps the employee with a lifestyle that seems out of step with their salary has a private source of wealth. You feel reluctant to accuse anyone, particularly someone trusted for years. You also worry about what happens if the suspicion proves correct.
The first decision isn't “Who is guilty?” It is “What must we preserve before anyone changes it?”
That distinction matters. A rushed confrontation can alert a suspect, trigger document deletion, or encourage funds to move. A poorly handled internal search can also contaminate witness accounts and make later findings harder to defend. The hidden signs of corporate fraud may justify concern, but signs alone don't establish misconduct.
Why speed changes the outcome
UK fraud work now involves high-volume, digitally enabled financial crime. The ONS estimate cited in the UK Finance material records 4.5 million fraud incidents and 3.8 million people experiencing fraud victim incidents in the year ending March 2026. The same release records a 15% rise in bank and credit account fraud to about 2.8 million incidents, while other fraud fell 37% to around 151,000 incidents. These figures show why an investigation often needs to move across banking records, accounting platforms, email, telephony, messaging applications, and devices, rather than sit inside one ledger.
Fraud investigation services exist to convert a concern into tested evidence. The right team will protect relevant records, reconstruct the financial trail, distinguish error from deception, and explain the result in language a board, insurer, solicitor, investigator, or court can use. Acting early doesn't mean accusing someone. It means protecting the business while the evidence remains available.
What Fraud Investigation Services Actually Cover
A forensic accountant sees fraud investigation as three connected tasks. Investigation establishes what happened. Quantification establishes the financial effect. Reporting establishes what can be proved. You need all three if the matter may lead to recovery proceedings, an insurance notification, a disciplinary hearing, or a police referral.
Investigation
The investigative phase tests the allegation against records and accounts. It can include tracing funds through bank statements, reviewing supplier and payroll data, comparing accounting entries with purchase orders, examining Companies House filings, and identifying related parties. Investigators may also preserve emails, image devices, review access logs, and examine communications across relevant platforms.
Interviews form part of the process, but skilled investigators don't begin by demanding a confession. They use non-leading questions, establish timelines, test contradictions, and compare answers with contemporaneous records. Where online activity matters, dark web monitoring for ethical hackers provides useful context on lawful open-source intelligence and monitoring practices.
Quantification
Finding an irregular payment isn't the same as proving loss. A quantification exercise identifies the amount lost, separates direct loss from consequential effects, considers recoveries, and explains assumptions. The output may support a civil claim, an insurer's claim assessment, a lender's decision, or criminal restitution.
The analysis must remain transparent. A reader should understand which transactions the investigator included, which they excluded, what records support each conclusion, and where uncertainty remains.
Reporting
Reporting turns the work into a usable product. A management report may help directors decide whether to suspend access, notify an insurer, change controls, or refer the matter. A court-facing report requires a different level of structure, independence, explanation, and supporting working papers.
This work overlaps with internal audit, HR, and policing, but it doesn't replace them. Internal audit evaluates controls and risk. HR manages employment processes. Police investigate offences using their statutory powers. A private investigator gathers evidence for the client and must remain independent if they may later act as an expert witness. They shouldn't write a conclusion designed to please the person paying the invoice.
The UK Investigation Process Step by Step
A sensible engagement starts with a free, confidential discovery call. The purpose isn't to decide guilt in one conversation. It is to triage the concern, identify whether the primary issue involves accounting, IT, employment, litigation, money laundering, or a mixture, and decide whether a forensic accountant is the right specialist.
Bring dates, amounts, names, relevant systems, and the documents already available. Don't edit, annotate, or forward suspicious material unnecessarily. The investigator needs the original context and a clear record of how each item came into your possession.
Scope before searching
The scoping letter should answer practical questions before fieldwork begins:
- Objectives: What questions must the investigation answer?
- Records: Which accounting, banking, HR, device, email, and corporate records are required?
- Legal setting: Is the work for management, a solicitor, an insurer, a regulator, or anticipated proceedings?
- Fees: Will the work use a fixed fee, a capped fee, or an agreed time basis?
- Limitations: What can the investigator test, and what remains outside the engagement?
That document prevents scope drift. It also lets the client obtain authority, involve solicitors, and preserve relevant information properly. Guidance on evidence gathering helps explain why preservation and authentication matter before analysis starts.
Collect, test, and corroborate
The investigative team may request a litigation hold, secure forensic images of devices, extract accounting data, and trace payments through bank records and corporate filings. It should maintain a chain of custody and record who collected each item, when they collected it, and how they stored it.
Investigators then compare independent sources. A bank statement may confirm a payment, while an email reveals who requested it and a supplier record shows whether goods ever arrived. Interviews test the human explanation, but the documents should lead the analysis.
The final stage produces either a management report or a CPR Part 35 expert report, depending on the intended use. If the matter proceeds, an expert may give evidence in court, mediation, or a disciplinary hearing. Missing records, deleted data, unclear authority, and delays in preservation all slow the work. Clients who provide system access, organisational charts, bank records, and relevant correspondence promptly give the investigation a better chance of producing a clear answer.
Why Businesses Delay and Why That Costs Them
Owners and directors usually delay for understandable reasons. They fear the fee, disruption, reputational damage, or the possibility that a trusted employee may face an allegation. Some worry that touching a device or account will destroy evidence. Others fear the most frustrating outcome, a costly investigation that finds no fraud.
Those concerns deserve a direct response. A clean investigation can protect a business just as much as a finding of wrongdoing. It can reassure a board, support an insurer's decision, help a lender understand the position, and identify a control weakness before the same issue becomes a larger loss.
Five objections that need a practical answer
“We can't justify the cost.” You don't need a full investigation on day one. Start with a confidential triage and a defined scope. The cost of disciplined fact-finding is easier to control than an open-ended loss, failed recovery attempt, or unsupported accusation.
“We can't disrupt operations.” A targeted review can begin with selected accounts, transactions, users, and periods. Investigators can work around critical processes while management keeps the business functioning.
“We might destroy evidence.” That risk supports professional preservation, not inaction. Stop routine deletion where possible, avoid speculative searches, preserve original files, and ask a solicitor or forensic specialist how to proceed.
“They've worked here for years.” Loyalty isn't evidence. Nor is suspicion. An independent review protects the employee as well as the organisation by testing the allegation against records rather than relying on office politics.
“What if we find nothing?” A documented conclusion still has value. It may narrow the issue to a control failure, accounting error, or employment matter and give directors a defensible basis for the next decision.
Digital records can disappear through ordinary retention settings, device replacement, access changes, or deletion. A suspect may also move assets once they realise the business is looking. Directors should take their governance responsibilities seriously under the Companies Act 2006 and obtain appropriate advice when a suspected loss affects the organisation's interests.
Act within days, not quarters. Early action doesn't prove misconduct, but delay can reduce the evidence available to prove or disprove it.
Evidential Standards and Expert Witness Work
A report that sounds convincing in a boardroom may fail under cross-examination. UK proceedings distinguish between the civil standard of proof, the balance of probabilities, and the criminal standard, beyond reasonable doubt. The investigator doesn't choose the outcome. They build a reliable evidential foundation and explain what the records support.
Civil Procedure Rules Part 35 requires an expert to assist the court, not the instructing party. That duty requires independence, clear reasoning, disclosure of material assumptions, and a statement of truth. A proper report identifies the instructions, describes the documents reviewed, explains the methodology, sets out findings, and separates fact from opinion.
The report must survive challenge
A forensic accountant should expect questions such as:
- Why did you treat this payment as loss?
- What alternative explanation did you test?
- Which records contradict the witness account?
- Did you account for recoveries, benefits, or avoided costs?
- Could another analyst reproduce your calculation?
- What did you not receive, and how does that limitation affect your conclusion?
Contemporaneous working papers provide the answer. They show the source of each figure, the logic behind each adjustment, the calculations performed, and the professional judgement applied. They also help the expert prepare for mediation, joint statements, or a court process in which opposing experts may discuss their differences directly, sometimes through hot-tubbing.
The FCA v Arch Insurance Supreme Court test case matters to forensic accountants dealing with business interruption claims because the Court substantially allowed the FCA's appeal on 15 January 2021, including cover that could apply to partial closure and some mandatory closure orders that weren't legally binding. Its related loss quantification methodology addressed trends clauses and rejected reducing valid claims merely because the same loss would have occurred due to the pandemic.
For investigators who want a wider framework for investigation management that holds up, the discipline is consistent: preserve the source, document the decision, test the alternative, and report without advocacy.
A forensic accountant's role doesn't end when the report is signed. They may need to explain technical accounting evidence to a judge, challenge an opposing calculation, or clarify the difference between an inference and a proven fact. That is why an evidence-first approach to forensic accounting should begin at the first document request, not shortly before trial.
Where These Services Make the Biggest Difference
A suspicious employee payment, a disputed business interruption claim, a charity funding concern, and a shareholder dispute look different on the surface. The practical question is the same: can you secure the evidence quickly enough to test what happened, quantify the consequence, and present findings that a decision-maker can rely on?
| Scenario | Trigger Event | Forensic Response | Typical Outcome |
|---|---|---|---|
| SME employee theft | Unexplained payments, altered supplier records, or unusual expenses | Review accounting data, trace bank movements, examine access records, and interview relevant staff | A supported finding, control recommendations, and evidence for recovery, disciplinary action, or referral |
| Business interruption insurance | Fire, flood, or another interruption followed by disagreement over the loss | Reconstruct trading performance, test records, assess policy wording, and quantify the claim | A transparent quantum schedule that supports negotiation, mediation, or litigation |
| Public sector or charity review | Funder, regulator, board, or audit concern about restricted funds | Test transactions against grant conditions, procurement rules, approvals, and related-party information | A documented conclusion, recoverable sums where supported, and stronger governance |
| Divorce or shareholder dispute | Concern that an owner or spouse has concealed value or diverted assets | Trace funds, review accounts and corporate records, assess transactions, and analyse valuation evidence | A defensible asset picture and financial evidence for settlement or court proceedings |
Public-sector investigations show the scale and structure this work can require. The Cross-Government Fraud Report records 8,069 fraud investigations opened and 9,345 closed by central government organisations in 2023/24, the first year departments reported investigation figures to the Public Sector Fraud Authority. The figures underline why businesses should set a clear scope early, preserve relevant records, and separate confirmed facts from working hypotheses.
The SFO annual report and accounts also illustrates the wider enforcement context, but it should not be treated as the source for territorial police referral statistics. For a business owner, the recommendation is straightforward: obtain the underlying data from the body that collected it, record its definition and reporting period, and avoid presenting a secondary summary as proof of the specific allegation.
Recovery requires action as well as analysis. The NCA reported that more than £5.1 million in cash was seized in less than twelve months, demonstrating that tracing and enforcement can produce tangible proceeds in fraud, money laundering, and disputed asset matters, according to its annual report and accounts.
The best investigation therefore starts with evidence that can survive scrutiny, then connects that evidence to recovery, discipline, settlement, or court action.
How Lighthouse Consultants Delivers Results
Lighthouse Consultants uses a structured model designed to keep the work focused. The first phase is a free discovery conversation. A London-based Chartered Management Accountant listens to the concern, identifies the decision you need to make, and separates urgent preservation steps from questions that can wait.
The second phase produces a fixed-fee or capped-fee action plan. It sets out the allegation or dispute, the records required, the proposed analysis, the intended audience for the output, and the constraints. That clarity matters when solicitors, insurers, police, HR teams, directors, or trustees all need different information from the same underlying investigation.
Four phases with a defined purpose
- Discovery: Establish the concern, urgency, stakeholders, and appropriate specialist input.
- Scoping: Agree questions, evidence requests, legal parameters, timetable, and fees.
- Fieldwork: Analyse accounts, trace funds, review electronic evidence, test controls, and quantify loss.
- Reporting: Deliver a management summary, evidential bundle, claims schedule, or CPR Part 35-compliant expert report.
The team can work under instructions from solicitors where privilege is appropriate, while recognising that privilege belongs to the client and depends on the legal structure of the engagement. It can coordinate with insurers, police, legal advisers, and internal teams without allowing those relationships to compromise independent reporting.
The service fits matters involving SME disputes, business interruption claims, public sector reviews, shareholder conflicts, bribery, corruption, due diligence, and asset tracing. The value of a multi-disciplinary team lies in translation. Raw transactions become a coherent chronology. A control weakness becomes a tested explanation. A disputed amount becomes a calculation another party can examine.
Lighthouse Consultants is one provider of fraud investigation services, offering forensic accounting, financial analysis, and independent reporting for matters that may proceed to negotiation, disciplinary action, insurance assessment, or court.
Your Next Move and What to Expect
Book a free, confidential discovery call before you confront an employee, amend suspicious records, or notify a wider group. Bring the basic facts, including relevant dates, approximate amounts, names of systems, bank information, invoices, contracts, emails, and anything already shared with a solicitor, insurer, auditor, or police force.
You should expect a practical triage rather than a sales presentation. The discussion should identify whether the issue warrants investigation, what evidence needs immediate preservation, whether another specialist should lead, and what a proportionate scope might look like.
A realistic route from concern to answer
Most scoping calls conclude within an hour. Initial action plans can arrive within five working days, while full reports commonly take four to eight weeks, depending on complexity, data quality, the number of transactions, the number of people involved, and whether electronic evidence requires specialist handling.
Confidentiality remains central. Legal privilege requires the right legal context and doesn't arise automatically merely because a forensic accountant participates, so involve your solicitor where privilege matters. The investigation should also explain its boundaries, including any missing records or assumptions that limit the conclusion.
The outcome usually falls into one of three categories:
- A clean bill of health, with control improvements or further monitoring recommended.
- A quantified finding, suitable for civil recovery, settlement discussions, or an insurance claim.
- A criminal-grade evidential package, capable of supporting a referral to the police or the Crown Prosecution Service, subject to the relevant authorities' decisions.
UK Finance reported £629.3 million stolen across 2.09 million confirmed fraud cases in the first half of 2025, while the industry prevented £870 million in attempted fraud during the same period, according to its Half Year Fraud Report 2025. That contrast reinforces the commercial point. Prevention and recovery depend on how quickly a business turns intelligence into preserved, usable evidence.
Don't wait for another quarter of management accounts. Write down what you know, preserve what you can without altering it, and arrange the conversation while the trail remains available.
Lighthouse Consultants provides UK fraud investigation services that combine forensic accounting, evidence review, loss quantification, and independent reporting for disputes, insurance claims, disciplinary matters, and court proceedings. Visit Lighthouse Consultants to book a free, confidential discovery call and turn an unexplained loss into a clear action plan.
