The current restructuring cycle has pressure points unlike any in recent memory. Loan default rates have settled at roughly 4.3% of issuers, well above the pre-pandemic 2–3% range, and roughly 80% of Chapter 11 activity has clustered in real estate, consumer goods, and energy and industrials. Persistent high rates, tighter private credit, compressed margins, and a wall of maturities are pushing more middle-market companies into workouts, refinancings, and Chapter 11 1.
Financial distress does not, by itself, mean fraud. Companies fail for many legitimate reasons – market shifts, operational missteps, customer losses, supply chain disruption, excess leverage, or growth bets that did not pay off. But distress narrows the margin for error. Cash tightens, reporting becomes urgent, and lenders, courts, boards, and counterparties make consequential decisions on information that must be accurate, timely, and complete. That is precisely when fraud, misconduct, or misstatement tends to surface.
In a distressed environment, the question is rarely whether the books are technically correct. The more important questions are practical: Where did the cash go? Are the assets real? Are liabilities understated? Are insiders or related parties receiving improper payments? Has collateral been overstated? Are financial reports creating a misleading picture for lenders, creditors, the board, or the court?
Forensic accounting provides a disciplined way to answer them – combining investigative analysis, document review, data analytics, and litigation support to determine what happened, who was involved, and what the financial impact was.
Why Pressure Breaks Controls
In a distressed company, normal controls erode in predictable ways. Approvals get informal, segregation of duties slips as accounting teams thin out, and reconciliations fall behind. The pressure to move quickly tends to outweigh the discipline of doing things properly, which gives management more room – intentionally or not – to override the controls that remain.
That does not make fraud inevitable, but it does elevate the risk – and complicate the diagnosis. Inaccurate financials can stem from poor systems and weak processes on one hand, or intentional conduct on the other. A forensic investigation’s role is to separate error from misconduct, and assumption from evidence.
Forensics Is Not an Audit
A financial statement audit is designed to provide reasonable assurance, within a defined scope and based on sampling, that financials are free of material misstatement. A forensic investigation is a different exercise entirely. It isn’t based on materiality and doesn’t deal in assurance. Its job is to establish what actually happened: what transactions occurred, who authorized them, who benefited, and the financial impact was. Put another way – auditors are trained to spot the risk of misstatement; forensic accountants are trained to reconstruct financial information rather than issuing an opinion.
That distinction matters because stakeholders in distress make high-stakes decisions on the answers. A lender is evaluating collateral. A court is weighing cash collateral, DIP financing, or plan feasibility. A creditors’ committee is assessing potential claims. A buyer is testing whether reported earnings and working capital are reliable. When the information is wrong, the consequences are real.
The FTX bankruptcy is instructive. The exchange had been valued at roughly $32 billion at its peak January 2022. When it filed for Chapter 11 in November of that year, John J. Ray III – who had previously overseen the Enron wind-down – wrote in his First Day Declaration that “never in my career have I seen such a complete failure of corporate controls and such a complete absence of trustworthy financial information.” A subsequent investigative report estimated that customer fund shortfalls exceeded $8 billion 2.
Preserve First, Investigate Second
The first step in any forensic engagement is preservation – locking down information before it disappears or becomes harder to reconstruct. In a distressed company, that is harder than it sounds; turnover, system migrations, vendor disputes, and management transitions may already be in motion.
Relevant material typically includes the general ledger, bank statements, borrowing base certificates, AR and AP detail, payroll and vendor master files, inventory records, wire activity, board materials, cash forecasts, and electronic communications. Preservation is not only a technical step; it is a credibility step – protecting privilege strategy for counsel, the integrity of the evidence for the court, traceability for lenders, and the CPA’s foundation to evaluate whether irregularities are isolated, systemic, or intentional.
Follow the Cash
In distressed situations, “cash is king.” A company may report revenue, assets, or EBITDA, but cash movement tells the more honest story. A forensic cash review typically includes proof-of-cash analysis, bank reconciliation testing, and close review of intercompany transfers, wires, check disbursements, related-party payments, and unusual receipts or withdrawals.
A common pattern: a borrower’s reported sales hold up, but the borrowing base drifts. Receivables age just slowly enough to remain eligible. Cash receipts, when traced, concentrate in a handful of customers – several sharing addresses or principals with insiders. The financial statements look unremarkable. The cash tells the real story.
Consider MF Global. When the broker-dealer filed for Chapter 11 in October 2011, roughly $1.6 billion in segregated customer funds were missing. The SIPA Trustee, James Giddens, retained forensic accountants from Ernst & Young and, under emergency conditions, traced more than $105 billion of cash movement across the firm’s final week. The work established that customer funds had been tapped to cover the firm’s own liquidity drains from European sovereign debt positions. Giddens’ 275-page Trustee Investigation Report became the factual basis for claims and recoveries ³.
In a restructuring or bankruptcy context, this analysis also supports preference and fraudulent transfer review, claims analysis, and evaluation of whether estate assets were diverted before or during the case.
Testing What’s Behind the Numbers
Records in a distressed company should be tested with skepticism – not an assumption of wrongdoing, but a recognition that pressure distorts reporting. A forensic review typically focuses on:
- Revenue and receivables. Whether sales are real, supported by delivery, and actually collectible, or being carried to prop up borrowing availability or enterprise value.
- Inventory. Whether it exists, is properly valued, and whether obsolete or slow-moving items are being treated as good collateral.
- Payables and accruals. Whether liabilities are complete, or whether expenses have been pushed into later periods to flatter current performance.
- Payroll and insider compensation. Whether the payroll contains ghost employees, unauthorized bonuses, improper reimbursements, or excessive insider payments.
- Vendor and procurement activity. Whether vendors are real and arm’s-length, or whether the file conceals related parties, kickbacks, conflicts, or inflated invoices.
In each area, the objective is not only to identify irregularities, but to determine whether they had a financial impact, who benefited, and whether the conduct was accidental, negligent, or intentional.
Analytics Without the Illusion of Certainty
Technology has made forensic work faster and more thorough, particularly when large transaction volumes must be reviewed under time pressure. Data analytics can surface duplicate payments, unusual vendor activity, transactions just below approval thresholds, and outliers across bank, ledger, payroll, and procurement data. Benford’s Law, trend and ratio analysis, keyword searches, and anomaly detection help focus attention where deeper review is warranted. Digital forensics may also recover deleted files, analyze metadata, and establish when documents were created or modified.
Analytics, however, do not replace judgment. A flagged transaction is a lead, not a finding. The same transaction may have very different explanations: a delayed vendor payment may be normal cash management; a rushed wire may be operationally necessary; a manual journal entry may be a legitimate correction. The forensic accountant’s job is to test the explanation against the evidence.
What Documents Don’t Tell You
Documents tell part of the story. Interviews fill in the rest. Employees, former employees, vendors, customers, and management each hold pieces of the timeline. Interviews can explain process breakdowns, identify who controlled key functions, and reveal whether policies were followed or routinely bypassed.
Interviews in distressed companies require care. Employees may fear job loss. Management may be defensive. Vendors may be unpaid. Insiders may have incentives to shape the narrative. A thoughtful interview process protects the integrity of the investigation and, for counsel, must be coordinated around privilege, confidentiality, and litigation strategy.
Red Flags Worth Taking Seriously
No single red flag proves fraud. But certain patterns – particularly in combination with liquidity pressure and weak controls – warrant attention.
- Reporting irregularities. Inconsistent borrowing base reporting; manual journal entries near covenant or reporting deadlines; missing or delayed bank reconciliations; expenses coded inconsistently across periods.
- Cash and vendor anomalies. Payments to new vendors without onboarding support; vendors sharing addresses, phones, or banking information with insiders; unusual payments to officers, shareholders, or related parties; inventory that does not reconcile to physical counts.
- Behavioral signals. Management restricting access to records or personnel; repeated, unsupported changes to cash forecasts; customer credits, write-offs, or reversals appearing just after reporting dates.
Building Findings That Hold Up in Court
Forensic findings are rarely the end product. They become evidence used in lender negotiations, litigation, bankruptcy proceedings, insurance claims, and settlements. How the work is documented is as important as what is found.
A strong forensic report explains the scope of work, the records reviewed, the procedures performed, the facts identified, what the financial impact, the limitations of the analysis, and the basis for any conclusion. In litigation, the work must also withstand scrutiny under Daubert and parallel state standards – reliable methodology, documented procedures, and conclusions that follow from the evidence rather than intuition or advocacy. The report must be understandable to non-accountants yet sound enough to withstand challenge.
From Discovery to Recovery
Identifying misconduct is only part of the work. Once irregularity is established, stakeholders must decide what comes next: pursuing recovery from insiders or third parties, filing claims, negotiating settlements, seeking insurance coverage, replacing management, or strengthening controls. In bankruptcy, findings may shape estate claims, plan negotiations, asset sales, and creditor recoveries.
The most useful forensic work is therefore not only backward-looking. It gives lenders a basis to reassess collateral and reporting; counsel a foundation for claims strategy; courts a clearer factual record; and management a clearer view of where reporting failed.
The Discipline of the Work
Fraud investigations in distressed companies demand urgency, independence, and discipline, along with a working understanding of the restructuring environment – incomplete information, tight timelines, competing stakeholder interests, and real legal consequences. The goal is not to assume fraud. The goal is to establish the facts.
In a distressed company, every dollar and every decision affects recoveries. Good forensic work – preserving the records, tracing the cash, testing the explanations, and documenting it all carefully enough to defend – is what turns suspicion into evidence and evidence into outcome. Done well, it does more than identify what went wrong. It gives stakeholders the one thing distressed companies most often lack: a factual record they can actually rely on.
