Expense Understatement and Liability Manipulation

Expense understatement takes several distinct forms, each with a different accounting mechanism and a different set of detection signals.

Capitalisation of operating costs is the most impactful of these methods because it simultaneously inflates the income statement and the balance sheet. The WorldCom fraud is the clearest large-scale example: line costs (fees paid to other carriers for network access) are inherently period operating costs under US GAAP, but were classified as property, plant, and equipment.

The fraud inflated operating income by the full cost in the period of misclassification and created a depreciating asset that would generate future amortisation charges, meaning later periods bore a burden that the manipulation created.

Accrual omissions are the most common technique because they can be executed by simply not processing end-of-period journal entries. A company that owes USD 2 million to a supplier for services received in December but records the invoice only when it arrives in January has understated December expenses and the year-end creditor balance by the same amount. The omission may be deliberate or negligent: the forensic auditor's task is to establish which.

Cut-off testing is the primary procedure for detecting period-end expense manipulation. The auditor selects a sample of transactions from two windows: typically the final two weeks of the period under review and the first two weeks of the following period. For each transaction, the auditor traces back to the underlying documents, including supplier invoices, goods-received notes, delivery confirmations, or service completion records, to establish the date on which the economic event occurred.

The test produces two types of findings. A transaction recorded in period T but with an economic event date in period T+1 is a premature accrual: it overstates period T expenses and understates T+1 expenses (this direction is less common in earnings-inflation frauds, but occurs in big-bath accounting).

A transaction recorded in period T+1 but with an economic event date in period T is an omitted accrual: it understates period T expenses and therefore overstates period T profit. In a financial-statement fraud context, the forensic auditor is primarily looking for the second type.

The sample selection in a forensic context differs from a routine statutory audit. A forensic auditor will often select the full population of large transactions near period-end rather than a statistical sample, will extend the look-back window further into the year if patterns indicate recurring manipulation, and will request original source documents rather than accepting representations from management.

Cut-off testing is most productive when it is paired with accounts-payable search procedures: requesting a listing of all unprocessed invoices held at year-end, comparing the creditor ledger balance to prior-period balances, and asking specifically about goods received but not yet invoiced.

Accounting provisions and reserves exist because many obligations become certain only after the balance sheet date. Allowances for doubtful debts, warranty provisions, restructuring accruals, and environmental remediation provisions are all estimates. That estimation discretion is the entry point for manipulation.

Management that wants to increase earnings in a particular period can release a provision without a documented change in the underlying obligation, can avoid adding to a provision despite deteriorating conditions, or can establish a large provision in a prior period and release it when needed.

Reserve analysis involves constructing a movement table for each significant provision: opening balance, charges in the period, amounts utilised, releases, and closing balance. The auditor then tests each movement. Charges should be supported by an updated estimate of the obligation. Utilisations should be matched to actual cash outflows or write-offs.

Releases require documentation that the underlying liability has genuinely reduced. Where a release is poorly supported, or where the timing coincides with a period in which earnings were under pressure, the auditor should treat that as a red flag requiring additional investigation.

Contingent liabilities under IAS 37 and ASC 450 require disclosure in the notes when a future obligation is possible, even if it does not yet meet the recognition threshold for a full provision.

Forensic auditors review the completeness of contingent liability disclosures by checking legal correspondence files, interviewing the general counsel, reviewing board minutes for discussions of pending claims, and comparing the company's disclosures to those of competitors facing similar litigation environments. An omission here can be as material as a missing line item on the face of the financial statements.

Off-balance-sheet financing allows a company to use assets and incur obligations without those items appearing in its consolidated financial statements, as long as certain accounting criteria are not triggered.

Before IFRS 16 (effective 2019) and the US ASC 842 (effective 2019 for public companies), operating leases kept significant right-of-use assets and corresponding lease liabilities entirely off the balance sheet. Major retailers and airlines carried obligations running to billions of dollars that were disclosed only in notes, using standardised capital value approximations, rather than appearing as recognised liabilities.

Special-purpose entities (SPEs) and variable interest entities (VIEs) create a parallel problem. A company that creates an SPE to hold debt-financed assets can keep the debt off its own balance sheet if the SPE is structured so that a small amount of outside equity bears the first loss.

Enron's use of SPEs named Raptor and LJM is the most studied example: these entities held Enron shares and had borrowed against them, but because the technical consolidation tests under old US GAAP were not triggered, the debt did not appear in Enron's consolidated statements. When Enron's share price fell, the hedging relationship collapsed, and USD 1.2 billion of equity disappeared in a single restatement.

Forensic auditors examining off-balance-sheet risk focus on three questions. First, does the company have any contractual obligations, guarantees, or contingent commitments not recognised on the balance sheet? Second, are there related parties or special-purpose vehicles that hold assets or liabilities economically linked to the company?

Third, do the post-IFRS 16 or post-ASC 842 recognised lease liabilities appear consistent with the disclosed operating lease commitments from the periods before those standards applied? A sudden drop in disclosed future operating lease commitments in the transition year, without a corresponding business explanation, can signal that commitments were restructured to avoid on-balance-sheet recognition.

See the ACFE Fraud Tree and Scheme Classification for the formal taxonomy that positions these techniques within the broader financial-statement fraud category.

A company that is manipulating expenses will typically show expense ratios that deviate from its industry peers. Cost of goods sold as a percentage of revenue, gross margin, selling, general, and administrative expense as a percentage of revenue, depreciation as a percentage of gross assets, and research and development expense as a percentage of revenue are all ratios that converge within an industry over time.

A company that reports a gross margin five percentage points above its closest peers for three consecutive years without a structural business explanation, such as a proprietary product or a demonstrably lower cost base, is a candidate for detailed examination.

Beneish's M-Score model, developed in 1999 using US public company data, uses eight financial ratios derived from a company's own accounts to produce a probability score indicating the likelihood that earnings have been manipulated.

The Days Sales in Receivables Index, the Gross Margin Index, the Asset Quality Index, the Sales Growth Index, the Depreciation Index, the Selling, General and Administrative Expense Index, the Debt-to-Assets Index (LVGI), and the Total Accruals to Total Assets ratio each capture a different dimension of financial pressure or accounting anomaly.

An M-Score above negative 1.78 indicates a higher probability of manipulation. The model is a screening tool, not a diagnostic: it identifies companies warranting closer inspection, not companies that have necessarily committed fraud.

Accrual analysis is a related analytical tool. The cash accrual ratio compares net income to operating cash flow. A company with consistently high net income and low operating cash flow is generating reported profit through accruals rather than cash receipts, which is a signal of either aggressive revenue recognition or understated expense accruals.

Sloan (1996) documented that companies with high accruals relative to assets earn lower subsequent returns, a finding that is consistent with the hypothesis that high accruals reflect earnings that are not sustainable.

When a forensic auditor has identified potential expense understatement or liability concealment, the next phase is gathering and preserving evidence sufficient to support a conclusion in legal proceedings. The standard differs from a statutory audit because the output may be used in civil litigation, criminal prosecution, regulatory enforcement, or arbitration, each with its own evidentiary requirements.

Documentary evidence includes original invoices, general ledger journal entries with approval trails, board minutes discussing provisions or capital expenditure decisions, emails and internal memos discussing accounting treatment, and management representation letters. In jurisdictions that have adopted electronic discovery rules, such as the US Federal Rules of Civil Procedure (FRCP 26 and 34) or the UK Practice Direction 31B, electronically stored information must be preserved from the point at which litigation is reasonably anticipated.

Under India's Bharatiya Sakshya Adhiniyam 2023 (which replaced the Indian Evidence Act 1872), electronic records are admissible as documentary evidence subject to a certificate of authenticity; forensic auditors working on Indian matters must ensure chain-of-custody documentation meets that requirement.

The forensic audit report must clearly distinguish between findings of fact, findings of accounting treatment, conclusions about whether accounting standards were violated, and any further conclusions about intent. Overstating the certainty of conclusions about intent is one of the most common failures in forensic accounting reports that are subsequently challenged in court.

A finding that a reserve was released without documentation of a change in the underlying obligation is a finding of fact. A conclusion that this was done to inflate earnings is an inference from that fact. A conclusion that a specific individual directed the release with knowledge that it was improper is a further inference, and requires proportionately stronger evidential support.

For further context on evidence-gathering procedures, see Evidence Gathering Methods in Fraud Examinations.