Bank statement analysis in forensic accounting rebuilds a complete record of cash movements from the statements, then answers a question about where money came from and where it went. The steps are scoping, loading every line into one table, a source and use of funds schedule, tracing transfers, and documenting each finding so another person can repeat it.
Scoping a forensic bank statement analysis: accounts, periods, parties
Scoping fixes the question, the accounts, the dates and the people before anyone opens a statement. A scope that is too narrow misses the account the money moved through, and one that is too wide buries the answer in data. Write it down, because later work is judged against it.
Start from the question
State the question in one sentence: where did the cash go between January and June, did the partner receive payments outside the agreement, or how much was paid to this vendor. The question decides what you request. A question about one vendor needs payments and the vendor file. A question about total diversion needs everything.
Accounts, periods and parties
List what to ask for:
- Accounts. Every operating, payroll, savings, credit card and loan account of the business, plus accounts of owners and related entities where the engagement allows access. Money rarely leaves by a single door, so one missing account can break the trace.
- Periods. Add a margin before and after the period under question. You need the opening balance of the first statement and the activity just before and after the period, to see whether patterns began earlier.
- Parties. Names of owners, signers, employees, vendors and customers who matter, with known aliases and account details. These become the search list later.
- Statement files. The original PDF or electronic file for each month, not a retyped copy.
Check completeness before you start
Confirm that you have one statement for every month of every account and that each statement's opening balance equals the prior month's closing. A missing month is a gap in the record, and you should say so in the report instead of bridging it with an estimate. If any statement came from a party with an interest, test it first, as described in how to detect fake bank statements.
Agree the rules of the engagement
Record who authorized access to each account, who may see the results, and where the files are stored. Note any limits, such as accounts you could not obtain. These notes protect the findings later.
Building a forensic transaction database from statements
A forensic transaction database is one table that holds every line from every statement, with the same columns for every account. It lets you sort, filter, total and trace. A pile of PDFs cannot be searched across accounts; a table can.
The columns that matter
Keep the source and the interpretation apart. A reasonable layout holds:
| Column | Holds |
|---|---|
| Account | The account the line came from |
| Statement | File name and page |
| Posting date | The date printed on the line |
| Description | The bank's text, unedited |
| Debit and credit | Amounts as printed |
| Printed balance | The balance after the line, when shown |
| Category | Your classification, added later |
| Counterparty | Your normalized payee name, added later |
| Notes | Anything you decide about the line |
The first six columns are raw and never change. The last three are your work, and they should be easy to separate from the raw data.
Getting every line in
Statements arrive as PDFs, sometimes scans. Typing them is slow and invites mistakes, so extraction tools are worth considering. Whatever the method, prove completeness: for each statement, the opening balance plus the extracted credits minus the extracted debits must equal the printed closing balance, and the line count must match. A statement that does not foot has a missing or misread line, and the difference points at it. Fix that statement before you analyze anything, because one misread amount can move a finding.
PreciseBankFlow is built for this step: it extracts each line, checks that the statement foots, scores its confidence in each field and lists what does not fit. The tracing, interpretation and conclusions remain with you.
Normalize the counterparties
Bank text is messy. The same vendor appears as three strings with different codes and dates. Create a counterparty column and map each variant to one name, keeping the original text in the description. Without it, totals by payee are wrong. After normalizing, check for duplicates: the rules for finding duplicate transactions on a bank statement apply directly to this table.
Source and use of funds schedules from bank data
A source and use of funds schedule lists where cash came from and where it went over a period, and it ties to the change in the bank balance. It is the core forensic schedule because it shows the whole movement on one page and exposes uses that the business cannot explain.
Build it from the database
Group credits into sources: customer receipts, transfers in, loan proceeds, owner contributions. Group debits into uses: payroll, suppliers, rent, transfers out, cash withdrawals, other. Total each group by month. Sources minus uses equals the change in balance, and opening balance plus that change equals the closing balance. If the schedule does not tie, there is an error in the data, not a finding.
Worked example: three months, one account
The figures below are fictional. They come from three months of statements for an example business with a single operating account.
| January | February | March | Total | |
|---|---|---|---|---|
| Opening balance | 40,000 | 32,100 | 26,750 | 40,000 |
| Sources | ||||
| Customer receipts | 52,000 | 48,500 | 55,300 | 155,800 |
| Transfers in from savings | 0 | 10,000 | 0 | 10,000 |
| Owner deposit | 0 | 0 | 5,000 | 5,000 |
| Total sources | 52,000 | 58,500 | 60,300 | 170,800 |
| Uses | ||||
| Payroll | 31,000 | 31,000 | 31,500 | 93,500 |
| Suppliers | 22,000 | 20,500 | 24,000 | 66,500 |
| Rent | 4,500 | 4,500 | 4,500 | 13,500 |
| Transfers to account ending 8842 | 0 | 6,000 | 9,000 | 15,000 |
| Cash withdrawals | 2,000 | 1,500 | 3,000 | 6,500 |
| Fees and other | 400 | 350 | 450 | 1,200 |
| Total uses | 59,900 | 63,850 | 72,450 | 196,200 |
| Net change | -7,900 | -5,350 | -12,150 | -25,400 |
| Closing balance | 32,100 | 26,750 | 14,600 | 14,600 |
Read the schedule
The schedule ties: 40,000 plus 170,800 less 196,200 equals 14,600. Now read it for questions, not conclusions. Receipts are stable, so the falling balance is not a sales collapse. Transfers to the account ending 8842 appear in February and grow in March, and no account with that number is in the scope. Cash withdrawals also rise in March. Those two uses total 21,500 over the period, and the schedule has just turned them into the first two requests: the owner of 8842, and the reason for the cash.
How do you trace money between accounts in a forensic review?
Tracing links a debit in one account to the credit it created in another, then follows that credit to its next use. The work is matching on amount, date and description across the database, with a rule for timing differences, and recording each link so the chain can be rechecked.
Match transfers across accounts
For every transfer out, search the other accounts for a credit of the same amount within a few business days. Record the pair. Unmatched debits point to an account you do not have, which is a finding about scope. Unmatched credits point to a source you have not explained.
Follow the money forward
When funds enter an account that holds other money, you need a rule for what left it. Forensic teams state their method, such as first in, first out, or tracing specific deposits to specific payments, and apply it the same way throughout. Choose it with counsel, record it, and say which method was used for each conclusion, because different methods can give different answers on mixed funds.
Handle timing and splits
A check written on the 28th may clear on the 3rd. A transfer may arrive in two parts, or two transfers may be combined. Allow a defined window, document matches that required judgment, and list unmatched items instead of forcing them. The patterns that make a tracing worth doing are described in embezzlement red flags such as new payees and round amounts, which you can run on the traced chain.
Test the database statistically
Alongside tracing, screening tests on amounts and dates can focus your attention. Fraud detection techniques used in forensic accounting explains which tests suit which data.
When not to use forensic statement analysis: lender cash-flow review
Forensic statement analysis answers "what happened to this money", and a lender's cash-flow review answers "can this business repay a loan". The inputs are the same statements, but the questions, depth and output differ. Using a forensic method for underwriting is slow, and an underwriting shortcut cannot support a legal finding.
What a lender needs
An underwriter wants average balances, deposit trends, overdrafts, and whether revenue is steady. The output is a view on capacity to repay. Detailed counterparty tracing and chain-of-custody notes add cost and rarely change the answer. A fast extraction and a cash-flow summary is the right tool.
What changes the choice
Switch to forensic work when the question becomes who received money, whether it was authorized, or whether the statements are reliable. A lender who sees round transfers to an unexplained account in a routine review may decide to escalate, and at that point the forensic steps in this post start. Until then the cheaper method is the correct one.
Do not use the wrong output
A cash-flow summary is not evidence of misconduct, and a forensic schedule is not an underwriting memo. Say in the report which question you answered, so no one reads one as the other.
What makes forensic bank findings hold up in court?
Forensic findings hold up when another competent person can start from the same statements, follow the stated method and reach the same numbers. Court-readiness is mostly documentation: the source of each file, the method for each step, and a record of every judgment call.
Source documents and custody
Keep each original statement as received, with who supplied it, when and how. Hash or lock the files if your practice does so. A finding based on a retyped statement is weaker than one based on the bank's own file, which is why confirming statements with the bank comes early in a dispute.
Reproducibility
Every number in the report should trace to lines in the database, and every line to a page of a statement. Keep the queries, filters and mappings you used. If you changed an extracted value, log what changed, who changed it, when and why. Check that totals tie before you report them.
Say what you did not do
State the limits: accounts not obtained, months missing, matches that required judgment, and questions the statements cannot answer. A report that names its limits is harder to attack than one that claims too much. Separate facts, such as the amounts moved, from opinions, such as whether a payment was proper. Which software helps with these records is covered in what forensic accounting software should prove.
Keep the reviewer's role clear
Tools do the extraction and arithmetic. The conclusions and signature belong to the accountant, and the report should say so plainly.