The price of a forensic engagement is set by its scope, not by the title of the person you hire: how many months are under review, how many bank and card accounts, how complete the records are, and whether the result is for you, an insurer or a court. The same suspected theft can be a fixed-fee ledger review or a months-long investigation with an expert witness at the end. This page explains the four levels of work, how each is usually priced, what makes the bill grow, and the steps that make it smaller. It does not quote hourly rates for forensic accountants or CPAs, because no primary source publishes them and the ranges circulating online are firms’ own marketing.
Suspect something in your own books? Our forensic bookkeeping service reconstructs your ledgers and documents exactly what happened, with a fixed-fee first phase and full confidentiality.
Before the fees, the number that should drive the decision. The Association of Certified Fraud Examiners’ Occupational Fraud 2026: A Report to the Nations, built from 2,402 cases investigated by Certified Fraud Examiners in 143 countries, found a median loss of $104,000 per case and a median of 12 months before a scheme was detected. Frauds caught within six months had a median loss of $40,000; schemes that ran more than five years had median losses above $1.1 million. Losses caused by owners and executives were more than nine times those caused by employees, and 43% of cases were found through tips. (Many articles still quote the higher median from the 2024 edition; the 2026 report is the current one.)
The practical reading is that the cost of looking is usually small next to the cost of another year of not looking, and that the cheapest engagement is the one that starts while the trail is short.
| Level | What it answers | Who does it | How it is usually priced |
|---|---|---|---|
| 1. Owner’s own review | Is there anything here worth paying someone to look at? | You, with read access to the books and bank | Your time: a few hours |
| 2. Forensic bookkeeping | What actually happened in the ledger, month by month, and how much is unexplained? | A bookkeeping firm that reconstructs and traces transactions | Often fixed-fee by phase, scoped to months and accounts |
| 3. Forensic accounting investigation | Who did it, how, and what is the provable loss? | A Certified Fraud Examiner or forensic CPA | Usually hourly against a retainer, sometimes with a cap |
| 4. Litigation support | Will this evidence hold up with opposing counsel, an insurer’s adjuster or a judge? | A forensic expert, usually hired through your attorney | Hourly, with separate time for reports, depositions and testimony |
Most cases do not need all four. Plenty stop at level 2, because the reconstruction shows sloppy books rather than theft, or shows a loss small enough to settle directly. Going straight to level 4 is right when you already expect to sue, prosecute or file a large insurance claim, because work done through your attorney is organised for that purpose from the start.
Months under review. This is the largest single driver. Every month means another set of statements to obtain, another reconciliation to rebuild, another batch of transactions to trace. Scoping usually starts with the period when the suspected person had access, not the whole life of the business.
Number of accounts and entities. Each bank account, credit card, payroll provider and payment processor is its own trail. Money that moves between related companies multiplies the work, because every transfer has to be matched on both sides.
Condition of the records. A reconciled QuickBooks file with statements on hand is the cheap case. Missing statements, unreconciled months, a deleted company file or a bookkeeper who kept the records at home all add time, and some of it is waiting time while banks produce copies.
Who will read the result. An internal findings memo for the owner costs less than a report written to an insurer’s proof-of-loss standard, which costs less than an expert report that has to survive cross-examination. Ask for the level you need, not the highest one on offer.
Whether the books must be rebuilt first. Forensic work on books that were never kept properly starts with a cleanup. If that is your situation, it may be cheaper to have the cleanup done as bookkeeping and bring in the investigator only for the specific questions it raises.
Check your insurance before you spend. Commercial crime or employee dishonesty coverage may reimburse the stolen funds, and some policies also cover the cost of establishing the loss; policies also carry notice and proof-of-loss deadlines that start when you discover the problem, so read yours early.
On the tax side, the IRS says theft losses are generally deductible in the year you discover the theft, unless you have a reasonable prospect of recovery through a claim for reimbursement, in which case the deduction waits until that is settled. Business theft losses are reported on Form 4684, Section B. How the investigation fees themselves are treated is a question for your CPA.
Many owners who call about fraud have a bookkeeping problem instead: unreconciled accounts, a departed bookkeeper who left no notes, or numbers that stopped making sense after a software change. That work is a cleanup, it is priced as one, and it is often the right first step either way, because a clean ledger is what any investigator would need to start from. If the cleanup turns up transactions with no business explanation, that is the point to escalate, and you will arrive with the reconstruction already done. The warning signs worth acting on are in 15 signs your bookkeeper is stealing, and the differences between bookkeeping, an audit and forensic accounting are set out in what forensic accounting is.
Where Numerawise fits: we do ledger reconstruction and discrepancy tracing (level 2), and we work alongside your CPA and attorney. We are not Certified Fraud Examiners, we are not an audit or attest firm, and we do not provide expert-witness testimony. If your case needs levels 3 or 4, we will say so on the first call.
It depends on scope: the months under review, the number of accounts and entities, the condition of the records and whether the result must stand up with an insurer or in court. Investigations by forensic accountants are usually billed hourly against a retainer. Forensic bookkeeping reviews are often priced as fixed-fee phases. Ask for a written first phase with a fixed fee or a cap.
Usually, if there is a specific suspicion. The ACFE’s 2026 Report to the Nations found a median loss of $104,000 per case and a median of 12 months before detection, with frauds caught in the first six months at a median $40,000. Starting early keeps both the loss and the review period small.
Preserve the evidence first: back up the company file, download statements, export the QuickBooks Online audit log (Intuit keeps two years of events) or run the Desktop Audit Trail report, and remove the person’s system access. Then write down exactly what you suspect so the work can be scoped.
The IRS says theft losses are generally deductible in the year you discover them, unless you have a reasonable prospect of recovery, and business theft losses go on Form 4684, Section B. Confirm the treatment with your CPA.
No. Forensic bookkeeping reconstructs and traces the ledger to show what happened. A forensic accountant or Certified Fraud Examiner investigates who did it and how, and can prepare evidence for insurers, prosecutors or courts. Many cases start with the first and only need the second if the reconstruction finds something.
Need a scoped first phase rather than an open-ended bill? Start with the free call on our forensic bookkeeping service page.
Tell us what you’re working on. We respond same business day.
Founder of Numerawise Solutions, established MMXXIV in Atlanta. Intuit ProAdvisor Gold tier. Former Intuit Technical Support engineer. Has personally led two hundred accounting software conversions for US small businesses since founding the practice. Reachable directly at [email protected].