Internal and Forensic Audit · Fraud Detecting Techniques

Investigative and Document Examination Techniques in Forensic Audit

Updated 11 October 2026 · Fact-checked

Investigative and document examination techniques are the traditional, mostly manual methods a forensic auditor uses to detect and prove fraud: interviews, surveillance, examining documents, vouching, reconciliations and analytical review. To answer an exam question, name the technique, explain how it is applied, link it to the facts, and state what evidence it produces.

Understand Investigative and Document Examination Techniques

Fraud rarely announces itself. A forensic auditor starts with a doubt: a red flag, a complaint or an unusual number. The traditional techniques turn that doubt into evidence that can stand before management, a regulator or a court.

There are two broad groups. Investigative techniques deal with people and behaviour: interviews, inquiries, observation and surveillance. Document examination techniques deal with paper and records: checking authenticity, vouching, reconciliations and analytical review. In practice you use them together. A reconciliation shows a gap, a document shows how it was created, and an interview shows who did it and why.

Interviews are structured conversations to collect facts. Witnesses and neutral staff are usually interviewed first, then people with some involvement, and the suspect last. By then you know the facts and can test the suspect's account against documents. Questions move from open and general to specific and closed. Keep notes, record the date, time and people present, and treat the interview as confidential. Where the law requires, do not threaten or induce the person, since that can weaken the evidence.

Surveillance means discreet watching of people, places or activity, for example watching stock movement at a godown or physical access to records. It must be lawful, approved by those in authority, planned and documented. Do not intrude on privacy or break any law. Observations are recorded with date, time, place and who observed them.

Document examination asks whether a document is genuine, complete, properly authorised and consistent with other records. You look for alterations, overwriting, missing serial numbers, duplicate invoices, unusual handwriting, photocopies in place of originals, backdating and approvals by the wrong person. Preserve originals, keep a chain of custody and work on copies wherever possible. Where authenticity is in doubt, an expert such as a handwriting or questioned-document examiner may be needed.

Vouching checks a ledger entry back to its supporting voucher, such as invoice, receipt, order or approval. Reconciliation compares two independent sources, such as bank statement and cash book, or vendor statement and payables ledger, and explains each difference. Analytical review studies ratios, trends and relationships, such as sudden margin changes or expenses rising faster than sales, to find areas needing deeper checks.

Key rules to remember

Vouching direction: Ledger entry → voucher → supporting documents and approval; Starts from the books and tests that each recorded entry is real and authorised. It tests for overstated or fictitious entries.
Reverse (tracing) direction: Source document → book entry; Tests completeness: whether genuine transactions were recorded. Useful for suppressed income or unrecorded liabilities.
Bank reconciliation: Balance as per cash book ± timing differences = Balance as per bank statement; Any difference not explained by timing items (cheques not presented, deposits in transit, charges not yet booked) needs investigation.
Interview sequence: Neutral witnesses → informed or involved persons → suspect; A rule of practice, not a statutory rule. It lets you build facts before confronting the suspect.
Analytical review ratio: Gross profit margin = (Gross profit ÷ Sales) × 100; Unexplained movement against past periods or industry may indicate manipulated sales, purchases or stock.

How to solve Investigative and Document Examination Techniques questions

Use this order for any question on investigative or document examination techniques, whether it asks for a definition, a comparison or a case.

1Identify what the question asks: explain a technique, choose techniques for a case, or evaluate an approach.
2Define the technique in one or two lines and state its purpose in detecting fraud.
3Explain how it is carried out: planning, steps, who is involved and what is recorded.
4Apply it to the facts given. Name the red flag in the case and the technique that suits it.
5State the evidence produced and its limits, for example that surveillance needs lawful conduct and interviews need corroboration.
6Add practical points: documentation, chain of custody, confidentiality, approvals and independence.
7Conclude with the recommended sequence of techniques and the next step, such as reporting to those charged with governance.

Quickest way: Red flag → technique → evidence

When to use it: Use it for short case-based questions when you have only a few minutes.

Underline the red flag in the facts (missing invoice, vendor with staff address, unexplained difference).
Match it: people behaviour points to interview or surveillance; paper doubt to document examination or vouching; numbers mismatch to reconciliation or analytical review.
Write two or three steps of how you would apply the technique.
State the evidence you expect and how you would preserve it.
Close with one line on the next step: escalate, widen the sample or interview the suspect last.

Common mistakes in Investigative and Document Examination Techniques

Treating vouching and tracing as the same thing.
Both involve matching records and the direction is easy to forget.
Fix: Vouching goes from book entry to document and tests for overstatement. Tracing goes from document to book and tests completeness.
Interviewing the suspect first.
Students assume the main person should be questioned early.
Fix: Interview neutral witnesses first, gather documents, and meet the suspect last, when you can test the story against evidence.
Describing surveillance without limits.
It sounds like unrestricted watching.
Fix: State that surveillance must be lawful, authorised, planned, discreet and documented, and must not intrude on privacy.
Listing document red flags without naming the action.
Students memorise signs of forgery but not the response.
Fix: After each red flag, add the step: obtain originals, preserve chain of custody, compare with other records, consider an expert.
Ignoring unexplained reconciling items.
Students treat reconciliation as a mechanical exercise.
Fix: Say that every difference must be explained and supported. Old or unsupported items are a fraud indicator.
Treating analytical review as proof of fraud.
An unusual ratio looks like a conclusion.
Fix: Present it as an indicator that directs further testing. Proof comes from documents, confirmations and testimony.

Worked examples

Example 1

During a forensic audit of Sundaram Traders Pvt Ltd, you find that several purchase invoices from one vendor carry consecutive numbers, have no GST registration details and were all approved by the same purchase officer. Explain how you would examine these documents and which other techniques you would use.

Show the solution

Red flag: consecutive invoice numbers from one vendor over different dates, missing registration details and a single approver suggest fictitious or inflated purchases.
Document examination: obtain original invoices, check for alterations, printing and signature similarity, and compare with the purchase order and goods received note.
Vouching: trace each payment entry back to the invoice, order, receipt of goods and approval. Check that approvals follow the authority matrix.
Reconciliation: compare the vendor's ledger and statement with the company's payables, and check payments against bank statements.
Verification: confirm the vendor's existence and address through independent sources and a physical visit, within lawful limits.
Interviews: speak to stores staff and accounts staff first, then the purchase officer last, with the documents in hand.
Preserve originals, maintain chain of custody, document everything and report findings to those charged with governance.

Answer: Examine the original invoices for authenticity, vouch the payments to orders, receipts and approvals, reconcile with the vendor and bank, verify the vendor independently, and interview the purchase officer last. Preserve evidence and report to those charged with governance.

Example 2

A company's bank reconciliation shows a cash book balance of ₹8,40,000. The bank statement shows ₹9,15,000. Cheques issued but not yet presented total ₹90,000 and bank charges not yet booked are ₹15,000. Check whether the difference is explained.

Show the solution

Start with the cash book balance: ₹8,40,000.
Cheques issued but not presented do not yet reduce the bank balance. They must be added to the cash book balance: ₹8,40,000 + ₹90,000 = ₹9,30,000.
Bank charges not yet booked reduce the bank balance but are not in the cash book. Deducting them from the adjusted amount: ₹9,30,000 − ₹15,000 = ₹9,15,000.
Compare with the bank statement: ₹9,15,000. The figures agree.
Difference between the two unadjusted balances was ₹75,000 (₹9,15,000 − ₹8,40,000), and the timing items explain it fully (₹90,000 − ₹15,000 = ₹75,000).
Still verify that the cheques were genuinely issued and later cleared, and that the bank charges are supported.

Answer: The difference of ₹75,000 is fully explained by cheques not presented (₹90,000) less unbooked bank charges (₹15,000). Even so, check that the unpresented cheques later cleared and are not old or unsupported.

Exam tips

Write techniques with a purpose, a method and the evidence produced. Three parts earn more than a definition.
In case questions, quote the red flag from the facts before naming the technique.
Always mention lawful conduct, confidentiality, documentation and chain of custody. Examiners look for practical compliance points.
For comparison questions, use direction of testing: vouching tests overstatement, tracing tests omission.
End your answer with the sequence of techniques and a reporting step, so it reads as a complete investigation.

Practice questions from Fraud Detecting Techniques

Investigative and Document Examination Techniques: frequently asked questions

What are the main investigative techniques in forensic audit?

The main ones are interviews, inquiries, observation and surveillance. Document examination, vouching, reconciliations and analytical review support them. In practice you combine them, since one technique alone rarely proves fraud.

How do you conduct an interview in a fraud investigation?

Plan the questions, interview neutral people first and the suspect last, and move from open to specific questions. Keep notes, record who was present and maintain confidentiality. Do not threaten or induce the person, and corroborate the answers with documents.

What is document examination in forensic audit?

It is checking whether a document is genuine, complete, authorised and consistent with other records. You look for alterations, missing numbers, backdating and duplicate items. Originals are preserved with a chain of custody, and an expert is used where authenticity is disputed.

How is surveillance done in a fraud investigation?

It is planned, authorised and discreet watching of people, places or activity, recorded with date, time and place. It must stay within the law and respect privacy. The findings support other evidence and rarely stand alone.