What are the best techniques for a forensic accountant to use when conducting an investigative interview?

Conducting investigative interviews is a core skill for forensic accountants. While financial data tells you what happened, interviews help uncover intent, collusion, and concealment.

Here are the best techniques for structuring and executing an effective forensic accounting interview:

• Start the interview with easy, background, and procedural questions to establish a baseline for the interviewee’s normal demeanor, speech patterns, and stress response.

• Avoid jumping straight into accusations or sensitive financial discrepancies, as an early defensive posture ruins the chance to read baseline behavior.

• Begin with open-ended questions (e.g., "Walk me through the standard approval process for a vendor invoice") to let them talk and potentially trap themselves in logical or procedural contradictions.

• Gradually narrow down to specific, closed-ended questions and direct exhibits (e.g., "Can you explain why this specific signature on Check#4 0 2 1 doesn't match your authorization limit?").

• Ask a difficult question or present a damning piece of evidence (like a forged ledger or unauthorized wire transfer confirmation), and stop talking.

• Interviewees often feel immense psychological pressure to fill the silence, frequently blurting out damaging admissions, rationalizations, or exposing co-conspirators just to break the uncomfortable quiet.

• People rarely confess if they feel backed into an unrecoverable social corner. Give the interviewee a face-saving, non-judgmental out or rationalization (e.g., "Sometimes cash flow gets so tight in a quarter that people borrow funds temporarily intending to put them back").

• Once a psychological rationale is provided, it lowers the barrier for the individual to admit to the initial wrongdoing.

• Never show your best piece of evidence first. Save crucial financial documents, emails, or bank records for the moment when the interviewee denies a premise they cannot wiggle out of.

• Document the contradiction immediately—have them explain the discrepancy while looking right at the physical proof.

• Pay acute attention not just to what is said, but how it's said (e.g., changes in pitch, avoidance of specific pronouns like "I" or "my," or repeating your question back to stall).

• Document verbatim quotes for critical admissions; changing a single word in a confession can compromise its legal utility later.

Interview Experiences

Practitioners often highlight how vital psychological readiness and patience are during these high-stakes conversations.

I found that letting them talk without interruption often reveals inconsistencies you wouldn't catch if you were too rigid with a script.

The silence is your best tool; people hate the quiet and will talk just to fill it up, often giving you more than you asked for.

If you'd like, I can dive deeper into:

• How to spot verbal and non-verbal deception cues during financial questioning
• Preparing an interview outline for a specific type of fraud (like embezzlement or bribery)
• Managing hostile or defensive witnesses

Let me know what aspect you'd like to explore next.

For a forensic accountant, the strongest investigative interviews are structured, evidence-driven, and non-confrontational. The goal is not simply to obtain a confession; it is to obtain accurate, complete, testable information that can be corroborated against financial records and other evidence. The ACFE and ICAEW both emphasize preparation, rapport, open questioning, and systematic follow-up.

1. Prepare before the interview

Do as much investigative work as possible before sitting down with the interviewee.

• Review the relevant general ledger, bank records, invoices, journal entries, emails, contracts, expense reports, system logs, and other evidence.
• Build a chronology of relevant transactions.
• Identify what you know, what you suspect, and what you don't yet know.
• Develop an interview outline with the topics you need to cover, but don't treat it as a rigid script. Good interviewers remain flexible when an unexpected lead emerges.
• Determine where the person fits in the investigation—witness, knowledgeable employee, victim, or potential subject.

A useful rule is: don't ask a question merely because it is on your list; ask it because the answer will advance the investigation.

2. Establish rapport and explain the purpose

Start with relatively neutral questions and establish a professional relationship.

Explain:

• Who you are.
• Your role in the investigation.
• Why you want to speak with them.
• What the interview will cover.
• Any applicable confidentiality or recording arrangements.

Rapport isn't just about being friendly. It can make the interviewee more willing to provide detailed information and can improve the flow of the interview.

Avoid beginning with accusations such as, "We know you manipulated these payments." That can cause the person to become defensive before you've obtained their account.

3. Begin with broad, open-ended questions

One of the most valuable techniques is to let the interviewee give their own account before introducing your evidence.

For example:

"Tell me about your responsibilities for the company's purchasing process." Then:

"Walk me through what normally happens from the time a purchase is requested until the vendor is paid." Follow with:

"What happened in this particular transaction?" Open questions encourage the person to provide information in their own words and can reveal facts the investigator didn't anticipate. Investigative-interviewing guidance specifically recommends obtaining the interviewee's account with a good open question and then probing individual topics.

4. Use a funnel approach

Move progressively from general → specific:

1. Establish background.
2. Understand the person's responsibilities.
3. Establish the normal process.
4. Discuss the relevant transaction or event.
5. Narrow down to dates, amounts, people, documents, and decisions.
6. Address discrepancies.
7. Ask about the person's knowledge or involvement.

This is particularly effective for forensic accounting because financial evidence tends to consist of interconnected transactions rather than one isolated event.

For example:

"Who normally approves vendor setup?" → "Who approved this vendor?"

→ "How did you know the vendor was legitimate?"

→ "When did you first communicate with the vendor?"

→ "Why was the bank account changed two days before the payment?"

Each question becomes more specific without prematurely revealing everything you know.

5. Use different types of questions deliberately

The ACFE describes introductory, informational, assessment, closing, and admission-seeking questions. Routine fact-finding generally emphasizes introductory, informational, and closing questions; assessment and admission-seeking questions become appropriate when the evidence warrants them.

Useful categories include:

• Open: "Tell me what happened."
• Clarifying: "When you say 'they,' who do you mean?"
• Specific: "Who entered the journal entry?"
• Closed: "Did you approve that payment?"
• Comparison: "How does that differ from the normal procedure?"
• Evidence-based: "The system shows the entry was posted at 11:42 p.m. How do you explain that?"
• Closing: "Is there anything else I should know about this transaction?"

Don't overuse leading questions. They can contaminate the account you're trying to obtain.

6. Let silence work for you

One of the most underrated techniques is simply waiting.

After asking an important question, don't immediately fill the silence. People often continue talking when given time to think—and the additional information can be more valuable than the initial answer.

For example:

"Who else knew about the arrangement?" Pause.

If the person gives a short answer, resist immediately moving on. A neutral follow-up such as "Tell me more about that" can produce substantially more information.

7. Test the account against the financial evidence

This is where the forensic accountant has a major advantage over a general interviewer.

Don't simply ask whether the person's story is true. Test it.

Suppose an employee says:

"I never had anything to do with that vendor." You might establish:

• Who created the vendor record?
• Who communicated with the vendor?
• Who approved invoices?
• Who changed the bank information?
• Who had access to the accounting system?
• What explains the emails?
• What explains the payment authorization?
• Why does the system log show the person's credentials?

Rather than arguing, progressively present objective inconsistencies and give the interviewee an opportunity to explain them.

8. Don't reveal all your evidence too early

A common mistake is showing the interviewee everything you know at the beginning.

Instead, preserve some information for later corroboration.

For example, if you know that a particular person changed a vendor's bank account, you might first ask:

"Who was responsible for maintaining vendor banking information?" Then:

"Did you ever make changes to vendor banking information?" Only later might you introduce the system record showing that the person's credentials were used for the change.

This can help you distinguish genuine knowledge from an answer constructed after seeing the evidence.

9. Treat inconsistencies as investigative opportunities

An inconsistency doesn't automatically mean someone is lying.

People can misremember dates, misunderstand accounting procedures, or confuse transactions.

Instead of:

"That's a lie. The records contradict you." Try:

"Help me understand something. You said the payment was approved on Monday, but the approval record shows Tuesday. What would explain that difference?" This gives the interviewee an opportunity to explain the discrepancy while potentially producing additional evidence.

10. Be cautious about "body language" and deception cues

Don't assume that nervousness, avoiding eye contact, fidgeting, or changes in voice prove deception.

The ACFE discusses evaluating verbal and non-verbal responses, but the more defensible approach is to use behavioral observations as prompts for further inquiry, not as proof of dishonesty.

A better approach is:

Observed change → investigate why → corroborate with evidence.

For example:

"You seemed very certain about the payment a moment ago, but you're now saying you don't remember who approved it. What changed?" Then verify the answer against the records.

11. Adapt the approach to the interviewee

A victim, witness, employee, and suspected perpetrator shouldn't necessarily be interviewed identically.

For victims in particular, trauma-informed interviewing can be important. ACFE guidance recommends open-ended questions, avoiding interruptions, allowing pauses, providing autonomy, and avoiding language that inadvertently blames the victim.

For a potentially culpable subject, the emphasis may shift toward detailed chronology, inconsistencies, corroborating evidence, and increasingly specific questions.

12. Close with the "anything else?" question

Before ending, ask something like:

"Is there anything else about this situation that you think I should know?" This sounds simple, but it can be extremely productive. Experienced fraud examiners specifically describe using an open-ended closing question to uncover unexpected information.

Also ask:

• "Who else should I speak with?"
• "What documents would help me understand this?"
• "Is there anything I've misunderstood?"
• "What do you think I should look at next?"

The last question can be particularly valuable because it may identify new witnesses, documents, accounts, or transactions.

13. Document the interview meticulously

Afterward, document:

• Date, time, location, and attendees.
• Questions asked and substantive answers.
• Documents shown.
• Important admissions or denials.
• Material inconsistencies.
• New investigative leads.
• Follow-up items.
• The interviewee's demeanor only where objectively relevant.

Then compare the account against the evidence rather than relying on your memory of the conversation.

A practical framework

A useful overall model is P.E.A.C.E.:

• P — Planning and preparation
• E — Engage and explain
• A — Account, clarify, and challenge
• C — Closure
• E — Evaluation

The model is increasingly used in investigative interviewing because it focuses on obtaining accurate and complete accounts rather than simply pursuing confessions.

The key principle

For a forensic accountant, the best interview is not an interrogation. Think of it as a controlled process for generating and testing evidence:

Prepare → build rapport → obtain the person's account → probe specifics → test against evidence → resolve inconsistencies → identify new leads → document and corroborate.

That approach tends to produce information that is not only useful to the investigation, but also much easier to defend later in an internal investigation, regulatory proceeding, arbitration, or litigation.

People can misremember dates, misunderstand accounting procedures, or confuse transactions.

Instead of:

"That's a lie. The records contradict you." Try:

"Help me understand something. You said the payment was approved on Monday, but the approval record shows Tuesday. What would explain that difference?" This gives the interviewee an opportunity to explain the discrepancy while potentially producing additional evidence.

10. Be cautious about "body language" and deception cues

Don't assume that nervousness, avoiding eye contact, fidgeting, or changes in voice prove deception.

The ACFE discusses evaluating verbal and non-verbal responses, but the more defensible approach is to use behavioral observations as prompts for further inquiry, not as proof of dishonesty.

A better approach is:

Observed change → investigate why → corroborate with evidence.

For example:

"You seemed very certain about the payment a moment ago, but you're now saying you don't remember who approved it. What changed?" Then verify the answer against the records.

11. Adapt the approach to the interviewee

A victim, witness, employee, and suspected perpetrator shouldn't necessarily be interviewed identically.

For victims in particular, trauma-informed interviewing can be important. ACFE guidance recommends open-ended questions, avoiding interruptions, allowing pauses, providing autonomy, and avoiding language that inadvertently blames the victim.

For a potentially culpable subject, the emphasis may shift toward detailed chronology, inconsistencies, corroborating evidence, and increasingly specific questions.

12. Close with the "anything else?" question

Before ending, ask something like:

"Is there anything else about this situation that you think I should know?" This sounds simple, but it can be extremely productive. Experienced fraud examiners specifically describe using an open-ended closing question to uncover unexpected information.

Also ask:

Conducting an investigative interview as a forensic accountant requires a blend of financial acumen and psychological strategy. The goal is to gather facts, test hypotheses, and observe behavioral cues without tipping your hand prematurely.

Key Techniques for Forensic Interviews

• Cognitive Interviewing: Encourages the interviewee to recall events from different chronological perspectives or sensory modalities to unearth forgotten details or inconsistencies.
• Document-Driven Questioning: Introduces physical evidence (like bank statements, emails, or invoices) strategically late in the interview after establishing baseline behaviors and pinning down the subject's narrative.
• Non-Confrontational Approach: Focuses on fact-finding rather than securing an immediate confession, which reduces defensiveness and keeps the lines of communication open.
• Open-Ended to Closed-Ended Funnel: Begins with broad, open-ended questions to let the subject talk freely, then narrows down to specific, targeted, closed-ended questions as the interview progresses.
• Pacing and Silence: Uses deliberate pauses after a question or a significant answer to encourage the subject to fill the silence, often leading to unprompted, revealing disclosures.
• Strategic Disclosure: Reveals evidence incrementally—starting with peripheral facts and moving to the "smoking gun"—to gauge reactions and prevent the subject from adjusting their fabricated story.

Would you like to explore how to structure the interview phases (prep, opening, core, and close) or look into identifying verbal and non-verbal deception cues?

For a forensic accountant, the strongest investigative interviews are fact-finding exercises supported by financial evidence, rather than confrontational interrogations. The goal is to obtain reliable information, test explanations, identify additional evidence, and—where appropriate—obtain admissions. The ACFE emphasizes preparation, question construction, rapport, documentation, and the ethical handling of resistance as core interview skills.

1. Prepare the financial evidence first

Before interviewing anyone, know the case better than the interviewee expects you to.

• Build a chronology of the transactions or events.
• Understand the relevant accounting records, internal controls, bank activity, invoices, journal entries, emails, and electronic evidence.
• Identify what you know, what you suspect, and what remains unknown.
• Prepare schedules that allow you to move from a general allegation to individual transactions.
• Identify inconsistencies that you can test during the interview.
• Decide which evidence to disclose immediately and which to hold back.

This is particularly important for forensic accountants because the interview should complement the documentary and digital evidence, not substitute for it. Recent research likewise describes interviews as useful for corroborating financial/electronic evidence, developing context, and evaluating competing explanations.

2. Start with rapport, not accusations

A professional, conversational approach generally produces better information than immediately telling someone they are suspected of fraud.

Begin with relatively neutral matters:

• Role and responsibilities
• Length of employment
• Normal processes and procedures
• Who performs particular accounting functions
• How transactions normally flow through the organization

Then transition naturally into the matters under investigation.

The ACFE specifically cautions against treating investigative interviews as Hollywood-style interrogations and emphasizes composure, preparation, and a fact-gathering mindset.

3. Use open-ended questions first

Start with questions that allow the person to tell their own story:

“Walk me through how a vendor gets established in the system.” “Tell me what happened with this payment.” “Describe your involvement in approving these invoices.” “Take me through what happened from the time you received the invoice until the payment was made.” This establishes the interviewee's narrative before you introduce your detailed evidence.

Then progressively narrow the questioning:

Open → specific → corroborative → contradictory

For example:

1. “Tell me how the vendor was established.”
2. “Who provided the vendor's banking information?”
3. “When did you first communicate with the vendor?”
4. “Was that communication by email or phone?”
5. “Our records show the bank account was changed on March 14. Who requested that change?”
6. “You said you had no involvement in the change. How do you explain this email from you requesting it?”

That progression helps distinguish genuine explanations from stories constructed in response to evidence.

4. Ask one question at a time

Avoid compound questions such as:

“When did you create the vendor, why did you do it, who helped you, and where did the money go?” The interviewee can answer whichever portion is most favorable.

Instead:

• “When was the vendor created?”
• “Who created it?”
• “Why was it created?”
• “Who supplied the banking information?”
• “Where did the payments ultimately go?”

The ACFE's current interviewing guidance specifically stresses questions that are simple, precise, direct, and focused on the critical information required.

5. Ask the interviewee to define important terms

Financial investigations are full of ambiguous language.

If someone says:

“I didn't approve the payment.” Don't assume you know what approve means.

Ask:

“What do you mean by ‘approve’?” Then establish the distinction between:

• preparing a transaction,
• reviewing it,
• authorizing it,
• entering it,
• releasing it,
• and ultimately benefiting from it.

This can be extremely effective because an interviewee may be technically truthful while using a different definition from the investigator. ACFE guidance specifically recommends clarifying mutually understood terminology.

6. Exploit the forensic accountant's greatest advantage: the numbers

Don't merely ask, “Did you steal $200,000?”

Use the financial trail to make the interview progressively more specific.

For example:

“You said you never dealt with this vendor.” Then establish:

• Who created the vendor?
• Who entered the bank account?
• Who approved the invoices?
• Who released the payments?
• Which computer was used?
• Who had access?
• Where did the payments go?
• Who communicated with the vendor?
• Who benefited?

The objective is to make the person explain the entire transaction chain, rather than simply answer a yes/no accusation.

7. Don't reveal all your evidence too early

Strategic disclosure is one of the most valuable techniques for a forensic accountant.

Suppose you have:

• an invoice,
• an email,
• an IP/login record,
• a bank statement,
• and evidence showing the money ultimately went to an account connected to the employee.

You don't necessarily want to put everything on the table at the beginning.

First obtain the person's independent account. Then introduce evidence incrementally.

This gives you an opportunity to compare:

What they said before seeing the evidence vs. How they explain the evidence after seeing it.

Recent ACFE guidance emphasizes minimizing interview “contamination”—including information that may influence or distort subsequent responses.

8. Use silence effectively

One of the simplest techniques is also one of the hardest to master: stop talking.

After asking:

“Why was the payment sent to that account?” let the silence sit.

Investigators often feel compelled to fill the silence. Don't.

People frequently elaborate when given time, and the additional explanation may reveal:

• new participants,
• previously unknown transactions,
• motives,
• inconsistencies,
• or evidence locations.

9. Test explanations rather than trying to prove your theory

A common forensic-investigation mistake is confirmation bias.

If you believe Employee A committed the fraud, don't conduct the interview merely to obtain confirmation.

Ask:

“What is your explanation for this?” Then genuinely evaluate it.

Consider alternative explanations and attempt to corroborate or falsify them. ACFE materials specifically identify interviewer bias as something that should be considered during preparation because it can contaminate the fact-finding process.

10. Don't over-rely on body language

Avoid simplistic conclusions such as:

“He looked away, therefore he lied.” Nervousness, hesitation, eye contact, posture, and changes in demeanor can have many explanations.

Behavioral observations are potentially useful in combination with the substance of the person's answers and the documentary evidence, not as a standalone deception detector. The ACFE's examination framework treats behavioral assessment and verbal/nonverbal clues as part of the broader interview process rather than as definitive proof of deception.

11. When appropriate, move from fact-finding to admission-seeking

If the evidence has established a sufficiently strong basis for suspecting culpability, the interview strategy can change.

At that point, you can methodically establish:

• what happened,
• when it began,
• how it was carried out,
• the amount involved,
• who else participated,
• why it happened,
• where the proceeds went,
• and where relevant evidence or assets can be found.

This should be reserved for situations where the evidence justifies it; ACFE guidance warns against using an admission-seeking approach prematurely because it can be unfair to potentially innocent subjects.

12. Ask questions about evidence you haven't yet found

This is especially powerful in financial investigations.

If someone admits manipulating invoices, don't stop there. Ask:

“What records would show me how you did that?” “Who else would know about this?” “What system did you use?” “Where would I find the original files?” “What account received the money?” “Were there other transactions handled the same way?” The interview can therefore become a mechanism for finding new evidence, not simply obtaining a statement about existing evidence.

13. Close by giving the person a chance to correct or add information

Before ending:

“Is there anything we've discussed that you want to correct?” “Is there anything important that I haven't asked you about?” “Who else should I speak with?” “Is there anything in the records that you think I've misunderstood?” This can produce valuable information—and demonstrates that the investigator gave the interviewee an opportunity to provide an alternative explanation.

14. Document the interview meticulously

Document:

• date, time, location, and participants;
• questions and significant answers;
• documents shown;
• admissions and denials;
• significant inconsistencies;
• names of additional witnesses;
• leads requiring follow-up;
• any requested or obtained statement.

If recording is contemplated, follow applicable law, organizational policy, and counsel's advice concerning consent and admissibility.

The ACFE identifies documenting the interview as a distinct component of interview theory and application.

A useful overall structure

For a forensic-accounting interview, I'd generally think of the sequence as:

Prepare → establish rapport → obtain the person's story → clarify terminology → drill into transactions → test against evidence → explore inconsistencies → identify additional evidence → address culpability when justified → obtain corrections/admissions → close and document.

The most important principle is don't try to win the interview. Your job is to obtain reliable information that survives comparison with the books, bank records, electronic evidence, witnesses, and other independent evidence. A well-prepared, adaptable, non-adversarial interviewer is generally more effective than an aggressive one.

For practical training, the acfe.com are a particularly useful starting point.

The interview can therefore become a mechanism for finding new evidence, not simply obtaining a statement about existing evidence.

13. Close by giving the person a chance to correct or add information

Before ending:

“Is there anything we've discussed that you want to correct?” “Is there anything important that I haven't asked you about?” “Who else should I speak with?” “Is there anything in the records that you think I've misunderstood?” This can produce valuable information—and demonstrates that the investigator gave the interviewee an opportunity to provide an alternative explanation.

14. Document the interview meticulously

Document:

• date, time, location, and participants;
• questions and significant answers;
• documents shown;
• admissions and denials;
• significant inconsistencies;
• names of additional witnesses;
• leads requiring follow-up;
• any requested or obtained statement.

If recording is contemplated, follow applicable law, organizational policy, and counsel's advice concerning consent and admissibility.

The ACFE identifies documenting the interview as a distinct component of interview theory and application.

A useful overall structure

For a forensic-accounting interview, I'd generally think of the sequence as:

For a forensic accountant, an investigative interview is most effective when it is treated as a structured fact-finding exercise supported by the financial evidence, rather than as an interrogation. Recent research and guidance from the Association of Certified Fraud Examiners (ACFE) emphasize preparation, carefully constructed questions, rapport, documentation, and corroboration.

Best techniques

1. Prepare extensively before the interview

   • Understand the alleged scheme, transaction flows, accounting entries, relevant policies, and key people.
   • Build a chronology and identify what you know, what you don't know, and what evidence could confirm or contradict the interviewee's account.
   • Prepare an interview outline, but remain flexible enough to follow unexpected information.

2. Start with rapport and a neutral tone

   • Introduce yourself and explain the general purpose of the interview.
   • Begin with straightforward background questions.
   • Avoid an accusatory tone, particularly when interviewing witnesses or people whose involvement has not been established.
   • A conversational, composed approach can encourage more complete disclosures.

3. Begin with open-ended questions Start broadly:

   • “Tell me what happened.”
   • “Walk me through your responsibilities for this process.”
   • “Describe how this transaction was initiated and approved.”

   Then progressively narrow the inquiry with specific questions. ACFE guidance distinguishes among open, closed, and leading questions and recommends using them strategically rather than indiscriminately.

4. Use the interviewee's own words If someone says, “I never handled the money,” don't immediately assume what handled means. Ask:

   • “What do you mean by ‘handled’?”
   • “What activities would you consider handling the money?”

   Defining important terms reduces ambiguity and makes later comparisons with documentary evidence much stronger.

5. Use financial evidence strategically—not all at once

   Don't simply put your entire evidence file on the table. Establish the interviewee's account first, then introduce relevant documents or transactions to test it.

   For example:

   “You said you never approved invoices for this vendor. Walk me through the approval process for this invoice.”

   You can subsequently introduce the approval record and ask the interviewee to explain the discrepancy. This approach allows the accountant to compare the narrative with independently established facts.

6. Follow the money and the chronology

   Financial investigations benefit enormously from chronological questioning:

   • Who initiated the transaction?
   • What happened next?
   • Who reviewed it?
   • Who authorized it?
   • Where did the funds go?
   • Who had access to the account?
   • What happened to the proceeds?

   For suspected fraud, questions should ultimately address such matters as participants, amounts, timing, intent, motive, disposition of proceeds, and physical or electronic evidence.

7. Use precise, direct questions when appropriate

   Once the facts have been developed, move from broad questions to specific ones:

   • “Did you approve this payment?”
   • “Did you create this vendor?”
   • “Did you receive any portion of the $50,000?”

   Avoid hypothetical or unnecessarily vague formulations that allow the interviewee to answer a different question from the one you intended.

8. Listen more than you talk

   One of the most valuable techniques is simply allowing silence after an important question. Don't immediately fill a pause. People often provide additional information when given time to elaborate.

   Also listen for inconsistencies in:

   • dates and sequences;
   • dollar amounts;
   • knowledge of accounting procedures;
   • explanations of unusual transactions;
   • relationships with vendors or customers; and
   • statements that conflict with documents or other witnesses.

9. Don't over-rely on body language or “lie detection”

   Behavioral observations can be useful investigative clues, but they shouldn't be treated as proof of deception. ACFE's examination framework recognizes behavioral assessment but emphasizes considering behaviors together and in context.

   A nervous person isn't necessarily lying; a confident person isn't necessarily truthful. Documentary and digital evidence should do the heavy lifting.

10. Test alternative explanations

A strong forensic interviewer actively considers explanations that could exonerate the subject:

• Was the unusual journal entry actually authorized?
• Could another employee have used the credentials?
• Is there a legitimate business reason for the related-party transaction?
• Could the accounting error have resulted from a system problem rather than intentional manipulation?

This protects the investigation against confirmation bias and makes conclusions more defensible.

11. Use discrepancies intelligently

If the interviewee gives an account that conflicts with your evidence, don't necessarily confront them immediately. First establish the account thoroughly. Then return to the specific inconsistency:

“Earlier you said X. Help me understand how that fits with Y.”

This gives the person an opportunity to explain the discrepancy while preserving the integrity of the interview.

12. Close with the “anything else?” question

Before ending, ask whether there is anything else the interviewee thinks is important. This deceptively simple technique can produce significant new information. Experienced fraud examiners have reported discovering major investigative leads this way.

13. Document the interview carefully

Record the date, participants, location, questions and answers, documents discussed, significant admissions, discrepancies, and follow-up items. ACFE identifies documenting interviews as a core component of fraud-examination interviewing.

A useful overall structure

A practical forensic-accounting interview can follow this sequence:

Preparation → rapport → background → open narrative → chronology → transaction-specific questions → evidence testing → discrepancies → motive/knowledge/intent where appropriate → additional leads → closing → documentation/corroboration

The key principle is “interview first, conclude later.” The forensic accountant should use the interview to obtain information that can be independently corroborated, rather than trying to force the interviewee into confirming a predetermined theory. Current academic research specifically finds that effective interviews can substantiate documentary/electronic evidence, uncover contextual details, and evaluate competing narratives.

For particularly sensitive or potentially admission-seeking interviews, the accountant should also consider applicable employment, legal, privilege, recording-consent, and due-process requirements and involve appropriate counsel or investigators where necessary. ACFE specifically identifies interviewees' legal and administrative rights as part of interview theory and application.

Useful starting resource: ACFE — Developing Your Interview Strategy, which provides a particularly practical framework for constructing questions and avoiding interview contamination. 

An investigative interview conducted by a forensic accountant is fundamentally different from a standard audit inquiry or a hostile police interrogation. Its primary goal is information gathering—transforming numbers into a narrative by validating electronic evidence, uncovering contextual details, and testing explanations.

The best techniques used by forensic accountants span strategic preparation, structuring, and behavioral analysis:

• Strategic Sequencing (The "Inside-Out" or "Peripheral-to-Core" Approach): Never start with the primary suspect. Accountants usually interview individuals farthest from the suspected irregularity (non-key personnel, peripheral vendors, or junior staff) first to establish the baseline process, moving progressively toward key management and finally the target. This ensures the investigator already holds the facts and contradictory details before sitting down with the suspect.
• Establishing a Baseline of Truth: Before diving into sensitive or incriminating topics, forensic accountants spend time on neutral, non-threatening background questions (e.g., employment history, general job duties) to observe the interviewee’s normal communication style, posture, baseline confidence, and verbal tone. Deviations from this baseline can signal evasiveness or deception.
• The Information-Gathering (PEACE) Framework: Modern forensic practices lean away from aggressive, accusatorial pressure tactics in favor of the PEACE model (P reparation/Planning, E ngagement, A ccount/Clarification, C losure, E valuation). The focus remains non-accusatory, treating the subject as a source of information first, which drastically reduces false confessions while securing actionable details.
• Utilizing Open-Ended Questions and Active Listening: Allow the interviewee to do the vast majority of talking. Asking open-ended prompts (e.g., "Walk me through how this invoice was approved") encourages a free flow of facts. Active listening ensures the accountant can pivot dynamically when unexpected details or names surface.
• The Power of Strategic Silence: When a difficult question is asked or an inconsistency in the financial records is laid bare, inexperienced interviewers tend to rush in and fill the silence. Forensic accountants use silence deliberately; subjects often feel an intense psychological need to fill the gap, frequently over-explaining, backtracking, or revealing unplanned clues.
• Having Hard Data in Hand: Confrontation—if necessary—should never rely on a "bluff." Forensic accountants bring specific, verified documentary evidence (bank statements, altered receipts, or signed check logs) into the later stages of the interview. Presenting indisputable facts calmly makes it difficult for a subject to maintain a fabricated story.
• Team Tag-Teaming: Best practice dictates deploying two professionals to the interview room—one primary lead who drives the line of questioning and maintains eye contact, and a second investigator whose sole responsibility is taking meticulous, contemporaneous notes and observing non-verbal micro-expressions.

Would you like to explore how to transition from a fact-finding interview into an admission-seeking interview , or do you need guidance on documenting and handling a sudden confession?

Forensic accounting interviews are most effective when treated as structured evidence-gathering exercises, not simply conversations or attempts to obtain a confession. The strongest approach combines careful preparation, open-ended questioning, corroboration, and disciplined evaluation of inconsistencies. The ACFE and AICPA both emphasize planning the interview, selecting appropriate question types, and using effective communication techniques.

1. Prepare before the interview

Build an interview plan from the evidence already available:

• Identify what you know, what you don't know, and what you need to establish.
• Review the general ledger, bank records, journal entries, emails, contracts, invoices, system logs, and other relevant evidence.
• Develop a chronology of events and identify gaps.
• Determine who should be interviewed and in what sequence.
• Separate facts from assumptions or allegations.
• Identify documents you may use to test particular statements.

A useful principle is to interview the least-involved or most knowledgeable witnesses first and progressively move toward subjects who may have greater involvement. This helps you obtain background information before confronting a potentially knowledgeable subject.

2. Start broad, then narrow

Begin with open-ended questions that allow the interviewee to provide their own account:

“Tell me how the purchasing process worked.”

Then progressively narrow the inquiry:

“Who approved the purchase?”
“When did you send the invoice?”
“What happened after that?”
“Who had access to the account?”

This approach reduces the risk that you're supplying facts to the witness and gives you an opportunity to discover information you didn't anticipate. The ACFE specifically distinguishes introductory, informational, assessment, closing, and admission-seeking questions and recommends moving from general information toward increasingly specific questions.

3. Let the person tell their story before showing your evidence

One of the most useful techniques is to obtain the interviewee's uncontaminated version of events before revealing everything you know.

For example, rather than immediately saying:

“We know you altered the vendor master file on March 14.”

ask:

“Tell me about the vendor-master changes made in March.”

Once you have their account, you can compare it with the documentary evidence. This can reveal omissions, contradictions, previously unknown participants, or explanations that can then be tested.

Recent ACFE guidance specifically stresses minimizing interview contamination—including contamination caused by the interviewer inadvertently supplying information or framing the issue prematurely.

4. Use precise follow-up questions

When an answer is vague, don't fill in the gap yourself. Make the interviewee define what they mean.

Useful follow-ups include:

• “What do you mean by ‘approved’?”
• “Who specifically did you speak with?”
• “When did that happen?”
• “How do you know that?”
• “What happened immediately afterward?”
• “Who else would know about that?”
• “What records would document that?”
• “When you say ‘we,’ who do you mean?”

This technique is particularly important in financial investigations because terms such as authorized, approved, reimbursement, transfer, customer, vendor, and personal use can have different meanings to different people. ACFE's current guidance recommends clarifying terminology to prevent ambiguity and opportunities to evade a precise answer.

5. Establish a detailed chronology

Financial misconduct often becomes clearer when events are reconstructed in time sequence.

For example:

1. Who initiated the transaction?
2. When?
3. What was the stated business purpose?
4. Who approved it?
5. What documentation existed?
6. Where did the money go?
7. Who had access to the account?
8. What happened afterward?

Chronology is particularly powerful because it lets you compare testimony against objective evidence such as bank timestamps, accounting-system audit trails, emails, text messages, and access logs.

6. Use documents strategically

Don't necessarily put all your evidence on the table at the beginning.

First obtain the person's account. Then introduce documents at appropriate points:

“You said the invoice was received on April 3. I'd like to show you this email. What does this tell you about when the invoice was actually received?”

This allows the evidence to test the person's explanation, rather than simply telling them what you believe happened.

It is also useful to ask the interviewee to explain documents rather than merely asking whether they recognize them.

7. Distinguish inconsistency from deception

This is crucial.

A contradiction doesn't automatically mean someone is lying. People can misunderstand dates, forget events, misinterpret accounting terminology, or genuinely remember things differently.

Look for corroboration, not merely suspicious demeanor.

AICPA's forensic-accounting training specifically addresses verbal and nonverbal deception, but behavioral indicators should be treated cautiously and in context.

In particular, avoid conclusions such as:

“He avoided eye contact, therefore he was lying.”

Instead ask:

“His explanation differs from the bank records. What explains that difference?”

The discrepancy between the statement and independently verifiable evidence is generally much more useful than a subjective interpretation of body language.

8. Don't argue with the interviewee

If someone gives an implausible explanation, resist the temptation to immediately say, “That's not true.”

Instead:

“Help me understand that.”

Then probe the explanation.

This often produces more information than confrontation. It also gives the person an opportunity to commit to a specific version of events that can subsequently be tested against the evidence.

9. Ask direct questions when appropriate

Open-ended questions aren't appropriate for everything.

Once you've established the relevant facts, use specific questions:

• “Did you authorize this payment?”
• “Did you receive the funds?”
• “Who gave you the password?”
• “Did you change the vendor's bank account information?”
• “Did you know the payment was going to your personal account?”

ACFE's current guidance emphasizes questions that are simple, direct, precise, and focused on the critical information needed.

10. Save important contradictions for the right moment

If an interviewee gives an answer that conflicts with your evidence, don't necessarily interrupt immediately.

Make a note and continue gathering the person's account. You may discover:

• additional witnesses;
• another explanation;
• additional transactions;
• previously unknown documents; or
• admissions that make the discrepancy more significant.

Then return to the inconsistency once you've established the relevant facts.

11. Use strategic silence

After asking an important question, stop talking.

Interviewers frequently undermine good questions by immediately asking another question or explaining why they asked it.

A person who has just been asked:

“Who received the money?”

may initially say, “I don't know.”

Silence can encourage them to elaborate:

“I think it might have gone to…”

That additional information may be much more valuable than anything the interviewer could have supplied.

12. End with an open invitation

One of the most valuable closing questions is essentially:

“Is there anything else you think I should know about this?”

Experienced fraud examiners report that this kind of closing question can produce unexpected information or even entirely new investigative leads.

Also ask:

• “Who else should I speak with?”
• “What records should I review?”
• “Is there anything in your explanation you want to clarify?”
• “Is there anything I haven't asked you about?”

13. Document the interview carefully

The interview record should distinguish:

• what the interviewee said;
• what the interviewer observed;
• what documents were presented;
• what evidence corroborates or contradicts the statement; and
• what investigative steps remain.

The objective is to create a reliable evidentiary record, not simply a narrative supporting the investigator's initial theory.

A practical framework

A good forensic-accounting interview can therefore follow this progression:

Prepare → establish rapport → obtain the person's narrative → clarify → establish chronology → test against evidence → explore inconsistencies → ask direct questions → identify additional evidence/witnesses → close with an open question → document and corroborate.

The biggest mistake is starting with the conclusion and trying to get the interviewee to agree with it. The better forensic approach is to let the evidence and the interviewee's own account progressively establish what happened.

For additional professional guidance, the ACFE interviewing resources and AICPA & CIMA forensic interviewing training are particularly relevant.

Conducting an effective investigative interview in forensic accounting requires a blend of psychology, rigorous preparation, and financial expertise. Unlike standard audit interviews, forensic interviews often involve subjects who may be defensive, deceptive, or actively hiding fraudulent activity.

Preparation and Strategy

• Master the Evidence First : Never enter an interview without fully understanding the relevant financial data, emails, and transaction trails (-e.g.,−negative− GL entries, bank statements). Knowing the facts prevents the subject from fabricating plausible-sounding lies.
• Establish a Clear Objective : Define what you need to achieve from the specific session—whether it is confirming a process, authenticating a signature, or eliciting an admission of guilt.
• Determine the Sequence : Interview peripheral witnesses and lower-risk personnel first to build an understanding of internal controls and operations before interviewing the primary target.

Questioning Techniques

• The Funnel Approach : Start with broad, non-threatening open-ended questions (-e.g., "Can you walk me through the approval process for this vendor?") to establish a baseline of the subject's normal behavior and speech patterns. Gradually narrow down to specific, targeted, and harder questions.
• Silence as a Tool : After asking a critical question, remain silent. Subjects often become uncomfortable with silence and will fill the void by over-explaining, backtracking, or offering unprompted admissions.
• Avoid Premature Accusations : Keep an objective and inquisitive demeanor rather than an accusatory one early on. Framing questions around anomalies or errors (-e.g., "Help me understand why this discrepancy occurred...") lowers defenses better than outright claiming fraud.

Behavioral Observation

• Watch for Baseline Shifts : Note how the subject reacts to benign questions versus sensitive financial topics. Sudden changes in posture, defensive language, nervous gestures, or changes in vocal pitch can indicate stress or deception.
• Listen to Verbal Cues : Pay attention to qualifiers, avoidance of specific names or amounts, or an overly rehearsed narrative. Deceptive individuals often distance themselves linguistically from the transactions in question.

Documentation and Closure

• Precise Note-Taking : Ensure contemporaneous, accurate notes or secure recordings (where legally permitted). Exact wording matters immensely if the case proceeds to litigation or criminal proceedings.
• The Concluding Summary : Summarize key points and agreements near the end of the interview to lock the subject into specific statements or timelines that can later be cross-checked against physical evidence.

Practitioner Perspectives

I found that starting with the simplest, least threatening documents sets a calm baseline. If their breathing or tone shifts dramatically when you slide a specific invoice across the table, the paper trail usually confirms why.

The hardest part is biting your tongue. When they stop talking after a tough question, every instinct tells you to speak up, but just letting the silence sit there usually forces them to reveal the real story.

If you're working on a specific case or scenario, let me know:

• Is the interview subject a cooperative witness or a suspected perpetrator?
• What type of fraud (e.g., embezzlement, asset misappropriation, financial statement fraud) are you investigating?

I can provide more tailored questions or strategy breakdowns.

For a forensic accountant, the strongest investigative interviews are fact-finding exercises, not confrontations. The goal is to obtain accurate, complete, corroborable information while preserving the interviewee's credibility and the evidentiary value of what is learned. AICPA guidance specifically emphasizes planning, interviewee selection, question strategy, communication techniques, and evaluation of verbal/nonverbal responses.

1. Prepare before you enter the room

Know the financial facts well enough that you can concentrate on the person rather than your spreadsheet.

• Identify the issues, hypotheses, and gaps you need the interview to address.
• Build a timeline of transactions, journal entries, payments, approvals, communications, and relevant events.
• Determine what evidence you already have and what remains unverified.
• Decide who should be interviewed and in what sequence.
• Prepare questions, but don't turn the interview into a rigid questionnaire.
• Know the interviewee's role, authority, responsibilities, relationships, and likely perspective.

This preparation is a core part of the AICPA's recommended interview-planning approach.

2. Use a PEACE-style structure

A particularly useful framework is PEACE:

1. Planning and Preparation
2. Engage and Explain
3. Account — clarification and challenge
4. Closure
5. Evaluation

The approach emphasizes obtaining reliable information rather than simply trying to secure a confession.

For forensic accounting, this works especially well because you can gradually move from someone's narrative to specific financial transactions and then to documentary evidence.

3. Start with broad, open-ended questions

Don't begin with, "Why did you transfer $75,000 to Company X?"

Start with something like:

"Walk me through your responsibilities for vendor payments."

Then:

"Tell me how the payment process worked from the time an invoice was received through final payment."

Only after obtaining the person's account should you narrow down to particular transactions.

Open-ended questions allow you to learn what the interviewee considers important, rather than merely obtaining answers to the facts you already suspect. PEACE-based interviewing similarly emphasizes free recall and allowing the person to provide an account before challenging it.

4. Follow the money—and the decision-making

This is where the forensic accountant's specialty becomes particularly valuable.

For each suspicious transaction, explore:

• Who initiated it?
• Who approved it?
• What was the business purpose?
• When was it initiated and completed?
• Where did the money ultimately go?
• How was the amount determined?
• Why was that method used?
• Who benefited?
• What documentation supports it?
• Who else knew about or participated in it?

Don't assume that the person who entered the transaction is the person who conceived or benefited from the scheme.

5. Ask "explain this" questions rather than accusation questions

Instead of:

"You created the fictitious vendor, didn't you?"

Try:

"Help me understand how this vendor came to be added to the system."

Then progressively test the explanation:

"Who requested the vendor?"

"Who provided the banking information?"

"Who verified it?"

"What documentation did you receive?"

"Who would normally perform that verification?"

This technique lets the interviewee commit to a narrative before you introduce contradictory evidence.

6. Use documents strategically

A common mistake is showing the interviewee everything you know at the beginning.

Instead, establish the person's account first. Then introduce evidence in a controlled sequence:

1. Establish the general process.
2. Establish the interviewee's responsibilities.
3. Establish the relevant transaction.
4. Obtain their explanation.
5. Introduce the relevant document or data.
6. Ask them to reconcile the discrepancy.
7. Explore who else can explain or corroborate it.

For example:

"You said you never communicated with ABC Consulting. Is there anyone else who would have been responsible for this relationship?"

Then later:

"I'd like to show you this email. What do you make of this communication?"

This gives you a much better basis for evaluating inconsistencies.

7. Don't overestimate body language

Watch behavior and changes in communication, but don't treat nervousness, eye contact, fidgeting, or other individual behaviors as proof of deception.

AICPA training specifically addresses verbal and nonverbal deception, but these observations are best treated as signals requiring follow-up, not conclusions.

A change from confident, detailed answers to unusually vague responses, for example, can justify:

"You were able to describe the process in considerable detail earlier. Help me understand why you don't recall this particular transaction."

8. Listen more than you talk

One of the biggest advantages an interviewer can have is patience.

Avoid immediately filling silence after asking a difficult question. People frequently add important information when given time to think.

Also listen for:

• unnecessary qualifications;
• changes in terminology;
• unusually precise or unusually vague recollections;
• distancing language ("they" rather than "we");
• unexplained gaps in a timeline;
• references to people or events you hadn't previously identified.

Those observations should generate new questions, not automatic conclusions.

9. Test alternative explanations

A good forensic interviewer tries to disprove the working theory.

If you believe an employee embezzled money, ask yourself:

"What innocent explanation could produce exactly the same financial pattern?"

Then interview to distinguish between those possibilities.

This protects against confirmation bias and makes your eventual findings much more defensible.

10. Separate knowledge from assumptions

For every important statement, determine whether the person:

• personally observed it;
• performed the action;
• was told about it;
• inferred it;
• or simply assumes it.

For example:

"How do you know the vendor performed that work?"

is considerably more useful than:

"Did the vendor perform the work?"

The first question gets at the basis of knowledge, which is critical when evaluating testimony against financial records.

11. Use strategic sequencing

A useful sequence is often:

Neutral/background → process → responsibilities → specific events → discrepancies → evidence → other participants → motive/benefit → closing.

Don't necessarily interview the primary suspect first. Witnesses and process owners can help establish facts that you can subsequently test with the principal subject.

ACFE likewise emphasizes that interview style should be adapted to the circumstances and the person being interviewed rather than applying one approach mechanically.

12. End by locking down important facts

Before ending, summarize the important portions of the account:

"Let me make sure I've understood you correctly..."

Then confirm:

• dates;
• amounts;
• participants;
• responsibilities;
• explanations for discrepancies;
• documents referenced;
• other people who should be interviewed;
• additional records that might corroborate the account.

Finally ask:

"Is there anything else about these transactions that you think I should know?"

and

"Who else would you recommend I speak with?"

The latter can produce surprisingly valuable investigative leads.

13. Document the interview carefully

Record the substance of the interview contemporaneously and follow applicable organizational, legal, and engagement requirements concerning recording, confidentiality, counsel, and interview documentation.

Immediately afterward, evaluate:

• What new facts were obtained?
• Which statements can be independently corroborated?
• What contradictions emerged?
• What evidence should now be obtained?
• What new witnesses were identified?
• Does the evidence strengthen or weaken the working hypothesis?

That final evaluation step is explicitly part of the PEACE model.

---

A practical formula

For financial investigations, I would boil the technique down to:

Prepare → build rapport → obtain the person's story → drill into transactions → test the story against evidence → explore discrepancies → identify corroboration → summarize and evaluate.

The key mindset is curiosity rather than accusation. Your job isn't to prove that your initial theory is right; it's to find out what actually happened and develop evidence that can withstand scrutiny. That's consistent with the modern investigative-interview approach emphasized by the FBI and ACFE.

If you're training forensic accountants, a particularly effective next step is to practice this with a mock embezzlement interview, including the financial documents, interviewer questions, suspect responses, and an analysis of what the interviewer did well or poorly.

Conducting an investigative interview as a forensic accountant requires a blend of financial acumen, psychology, and strategic communication. Unlike a hostile cross-examination, an effective investigative interview is a structured conversation designed to uncover anomalies, corroborate documents, and assess credibility.

• Preparation and Material Mastery, review all financial records, ledgers, bank statements, and C₆H₁₂O₆-level transaction details beforehand so you control the facts and the subject cannot easily fabricate a plausible narrative.
• The Funnel Approach, structure the interview by starting with broad, non-threatening background questions, moving into operational specifics, and finally narrowing down to the hard, confrontational financial anomalies or discrepancies.
• Cognitive Interviewing Techniques, encourage the subject to recall events in reverse chronological order or from different perspectives to disrupt rehearsed scripts and expose inconsistencies in fabricated stories.
• Active Listening and Observation, pay close attention not just to what is said, but how it is said—watching for evasive language, sudden shifts in posture, or unprompted volunteered details that over-explain a simple transaction.
• Strategic Silence, use deliberate pauses after asking a tough question or after the subject finishes an answer; discomfort often prompts the subject to keep talking and reveal unintended information.
• Document-Centric Questioning, anchor your questions to physical evidence rather than personal accusations (e.g., "Help me understand why this H₂O-related utility expense or invoice doesn't match the vendor ledger" rather than "Why did you steal this money?").

Would you like me to elaborate on how to structure the questioning sequence for a specific type of fraud, such as asset misappropriation or financial statement fraud?