# Forensic Audit Checklist for Bank Records

- Author: PreciseBankFlow (https://precisebankflow.com)
- Published: 2026-10-17
- Category: Fraud and forensic review
- Canonical: https://precisebankflow.com/blog/forensic-audit-checklist

> A forensic audit checklist for bank records: obtaining complete statements, preserving originals, testing integrity, analyzing and documenting each step.
A forensic audit checklist for bank records runs in five stages: obtain every statement for every account, preserve the originals, test that each statement is genuine and foots, analyze the transactions, and document each step so another expert could repeat it. The order matters, because analysis on an incomplete or altered set proves nothing.

## What belongs on a forensic audit checklist for bank records?

A forensic audit checklist for bank records lists the steps that turn a pile of statements into evidence: collection, preservation, integrity testing, analysis and documentation. Each item should leave a record behind, such as a log entry, a schedule or a signed note, so the checklist doubles as proof that the work was done.

The stages build on each other. You cannot test integrity before you know the set is complete, and you cannot defend an analysis if you cannot show where each file came from. Skipping ahead is the most common way a sound finding becomes easy to attack.

The full checklist sits in the five sections below. Each item is written as an action, followed by the evidence it should leave. Treat it as a starting point for a specific engagement, not as a form to fill in blindly.

## Checklist stage 1: obtaining a complete set of bank statements

Stage one proves you hold every account, every month and every page in scope. A forensic audit built on eleven months of a twelve-month period, or on one of two operating accounts, can be undone by the missing piece. Completeness is shown with lists and continuity checks, not by assumption.

1. **List every account in scope.** Use the general ledger, prior tax returns, loan files and interviews. Evidence: an account list with the source for each entry.
2. **Ask each bank for a list of accounts held** by the entity or person, with consent or legal process. Evidence: the bank's reply.
3. **Request statements directly from the bank** where you can. Evidence: a request log with dates.
4. **Check month-to-month continuity.** Each closing balance must equal the next opening balance. Evidence: a continuity schedule per account.
5. **Check page counts.** Many statements print "page 3 of 6." Evidence: a note of any missing page.
6. **Collect check images and deposit item images** for the same period. Evidence: an image index.

Closed accounts belong on the list too. An account shut halfway through the period may have received the money that matters, and its final statement is often the one nobody kept. Ask the bank for closing statements and the date and method of the final withdrawal. If the balance left by check, the check image shows where it went.

Continuity checks across several accounts take discipline. The order of work used in [reconciling multiple bank accounts at month-end](/blog/reconcile-multiple-bank-accounts) applies here too, especially for transfers that leave one account and should arrive in another.

## Checklist stage 2: preserving the original bank records

Stage two keeps the original files exactly as received and moves all analysis onto copies. If someone later claims a statement was changed during the audit, you need to show it was not. Logging receipt and fixing each file with a hash value does that.

7. **Log receipt of every file**: who sent it, how, when, and who received it. Evidence: an intake log.
8. **Compute a hash value** for each PDF or data file on receipt, such as SHA-256, and record it. Evidence: a hash list.
9. **Store originals read-only** in a location only the engagement team can reach. Evidence: an access list.
10. **Work on copies** and name them so they cannot be confused with originals. Evidence: a folder structure that separates the two.
11. **Keep paper originals sealed and signed across the seal** when they are not in use. Evidence: a custody form for each transfer.

The detail of logging, hashing and handover is covered in [keeping chain of custody for financial records](/blog/chain-of-custody-for-financial-records). For a checklist, the point is simple: if an item cannot be traced from the bank to your file, mark it as such in the log.

## Checklist stage 3: integrity tests before any statement analysis

Stage three confirms each statement is genuine and internally consistent before you rely on it. A statement supplied by the person under review should be treated as untested. Integrity tests include footing the statement, recomputing running balances, comparing against bank-sourced copies and inspecting the file itself.

12. **Foot each statement.** The opening balance plus credits, less debits, must equal the printed closing balance. Evidence: a footing schedule with any difference.
13. **Recompute running balances line by line** where the bank prints them. Evidence: the first line where a break appears.
14. **Compare supplied statements with bank-sourced copies** for a sample of months, or all months if any differ. Evidence: a comparison table.
15. **Inspect PDF properties and text layers** for signs of editing. Evidence: a note per file.
16. **Check check-number sequences** for gaps and repeats. Evidence: a gap list.
17. **Rate extraction confidence** if statements were converted to data, and vouch low-confidence lines to the PDF. Evidence: a vouching list.

Item 17 is easy to forget. A converted transaction table is a new document, and every figure in it must trace to a page. PreciseBankFlow attaches a confidence score to each field it reads and flags statements that do not foot, which gives you the vouching list and the footing schedule for items 12 and 17 in one pass; you can [see how it works on the homepage](/).

## Checklist stage 4: analysis tests on the forensic transaction table

Stage four runs tests on the cleaned transaction table to surface the items worth a closer look. Start broad, with summaries by payee and month, then narrow to rule-based and statistical tests. Every test should produce a list of specific transactions, not a general impression.

18. **Build one transaction table** across all accounts with source references (account, statement, page, line). Evidence: the table and its field list.
19. **Summarize by payee, by month and by account.** Evidence: pivot schedules.
20. **Match transfers between accounts** and list any transfer with no partner. Evidence: an unmatched transfer list.
21. **Run duplicate and gap tests** on payee, amount, date and check number. Evidence: exception lists.
22. **Run outlier tests** such as round amounts, amounts just under approval limits and unusually large payments to one payee. Evidence: flagged item lists.
23. **Trace flagged items to documents**: invoices, approvals, contracts. Evidence: a tracing schedule with outcomes.

The methods behind items 19 to 22, including link analysis between payees and accounts, are covered in [forensic data analytics on bank transactions](/blog/forensic-data-analytics). Choosing tools for this stage is its own decision; [what forensic accounting software should prove](/blog/forensic-accounting-software) lists the features that matter.

## Checklist stage 5: documenting every forensic audit step

Stage five writes down what was done, with what data, and what was found, so an opposing expert could repeat the work and reach the same numbers. Documentation is not a final tidy-up. It should be written as each stage finishes, while the reasons for each choice are still fresh.

24. **Keep a work log** with date, person, step, input files and output files. Evidence: the log itself.
25. **Record every assumption**, such as treating a transfer as personal or including a disputed month. Evidence: an assumptions schedule.
26. **Keep the scripts, formulas or tool settings** that produced each schedule. Evidence: an archive of the working files.
27. **List what was not tested** and why. Evidence: a scope limitations note.
28. **Have a second person review** key schedules against source. Evidence: reviewer initials and date.

### A worked example of one documented step

The entry below shows the level of detail that item 24 needs. The values are an example.

| Field | Example entry |
| --- | --- |
| Date | 2026-08-04 |
| Person | J. Rivera |
| Step | 21, duplicate test on payee and amount within 5 days |
| Input | transactions_v3.xlsx, hash recorded in the hash list |
| Output | duplicates_2026-08-04.xlsx, 14 pairs flagged |
| Outcome | 11 pairs explained by recurring rent and software fees; 3 pairs sent for tracing |

A reviewer reading that entry knows what was tested, on which version of the data, and what happened to every flagged item.

## Where does a forensic audit checklist fall short?

A forensic audit checklist falls short when the scheme does not touch the bank accounts in scope, when records are deliberately incomplete, or when the team follows the list mechanically. A list tells you what to do; it cannot tell you what the subject did to avoid it. Revisit the checklist whenever a new fact changes the question.

Three gaps come up often:

- **Cash that never reached the bank.** Skimmed receipts leave no trace on a statement. You need sales records, register tapes or customer confirmations to compare against deposits.
- **Accounts nobody told you about.** A personal account used to receive diverted payments may only surface through a bank-wide account search, a tax return or a payee name that leads somewhere unexpected.
- **Tests run without a question.** Running every test on every account produces long exception lists and little insight. Tie each analysis item to the question in the engagement letter.

When a checklist item does not apply, say so in the log and give the reason. An unexplained skipped item looks like an oversight to a reviewer. An explained one shows judgment, which is what the work is supposed to show.