Fraud Investigation and Forensic Auditing Training Course

Duration 10 days 20 modules · 65 contact hours
Level Intermediate Certificate on completion
Who attends Internal Auditors, Forensic Auditors and others
Fee from USD 2,200 KSh 190,000 for Kenyan organisations
Where 52 cities + online See dates by city
Next start 16 Nov 2026 Course code SD-FFC-040

Before you join: Participants should have working familiarity with accounting records, internal controls, financial transactions or audit evidence.

Dates & prices

Two start dates a month in every city, and live online on weekdays or weekends. Fees are per participant; classroom fees include tuition, materials, lunch and refreshments, and the certificate.

Suggest a date or city

Showing the next six months. Later dates, other cities and private deliveries for your team are available on request.

Course overview

Fraud allegations demand more than a suspicious transaction or an audit exception. Investigators must establish facts, preserve admissible evidence, test competing explanations, quantify losses and communicate findings without prejudicing disciplinary, civil or criminal proceedings. Weak case scoping, poor evidence handling and unstructured interviews can turn a valid concern into an unproven allegation, expose the employer to legal challenge and allow control failures to continue.

This course teaches the forensic auditing and investigation methods used to examine suspected occupational fraud, corruption, procurement irregularities, financial statement manipulation and misappropriation of assets. Participants learn to scope allegations, develop investigation hypotheses, plan evidence collection, analyse accounting records and digital data, conduct fact-finding interviews, document findings and recommend corrective controls. The course also addresses confidentiality, legal boundaries, chain of custody, privilege considerations and the distinction between investigative work and a statutory financial audit.

Teaching combines short technical briefings with realistic cases involving false vendors, expense fraud, payroll manipulation, bribery indicators and revenue misstatement. Participants work with investigation plans, transaction extracts, evidence logs, interview records and report structures. They progressively build an investigation case file, culminating in a reviewed and presented forensic audit report package containing an allegation assessment, evidence plan, analytical findings, loss calculation and control recommendations.

The course suits finance, audit, compliance, risk, legal and investigative professionals who may lead, support, commission or review fraud investigations. It is particularly relevant for organisations handling public funds, regulated financial services, donor-funded programmes, complex procurement or decentralised operations.

What you will be able to do

  • Assess fraud allegations using the ACFE Fraud Tree, fraud indicators and case hypotheses
  • Develop a risk-based fraud investigation plan with objectives, scope, resources and milestones
  • Preserve physical, documentary and digital evidence using chain-of-custody procedures
  • Apply forensic accounting tests to identify unusual transactions, concealed relationships and loss patterns
  • Conduct structured fact-finding interviews using the PEACE interviewing framework
  • Quantify suspected fraud losses and document assumptions, supporting records and calculation methods
  • Draft a defensible forensic audit report separating facts, analysis, conclusions and recommendations
  • Design corrective controls and fraud risk treatments from investigation findings

Benefits of attending

For you

  • Produce investigation plans that withstand management, legal and audit scrutiny
  • Recognise accounting patterns associated with concealed fraud schemes
  • Handle evidence records without compromising traceability or confidentiality
  • Conduct better fact-finding interviews and document reliable interview evidence
  • Write findings reports that support disciplinary, recovery and control decisions

For your organisation

  • Earlier identification and escalation of credible fraud allegations
  • More consistent evidence handling across audit, compliance and investigation teams
  • Better-supported loss recovery, disciplinary and remediation decisions
  • Clearer root-cause analysis of control failures behind fraud incidents
  • Reduced repeat exposure through targeted fraud risk treatments and controls

Course modules

20 modules over 10 days

Participants can classify allegations and define the purpose of a forensic audit engagement.

  • Fraud triangle, fraud diamond and behavioural red flags in case assessment
  • ACFE Fraud Tree categories and loss typologies for initial scoping
  • Occupational fraud schemes: corruption, asset misappropriation and financial statement fraud
  • Distinguishing error, policy breach, misconduct and prosecutable fraud allegations
  • Materiality, intent and concealment indicators within financial records
  • Case hypotheses framed using who, what, when, where and how

Participants can prioritise allegations using risk, impact, evidence availability and urgency criteria.

  • Fraud risk factors mapped to processes, people, systems and third parties
  • Allegation intake criteria covering source reliability, specificity and corroboration
  • Risk scoring matrices for financial loss, reputational harm and legal exposure
  • Triage decisions: monitor, refer, investigate, suspend or close allegations
  • Conflict-of-interest checks for investigators, reviewers and decision makers
  • Escalation thresholds for senior management, boards, regulators and law enforcement

Participants can prepare a documented investigation plan with appropriate governance and controls.

  • Investigation objectives linked to allegations, decisions and required proof
  • Scope statements defining entities, periods, transactions, locations and individuals
  • Work breakdown structures for evidence, analytics, interviews and reporting
  • RACI matrices assigning investigators, legal counsel, management and specialists
  • Milestone plans controlling urgency, dependencies, approvals and reporting dates
  • Confidentiality protocols protecting whistleblowers, witnesses and case information

Participants can identify legal and ethical constraints affecting an internal fraud investigation.

  • Presumption of innocence and neutral language during allegation assessment
  • Employment law considerations for suspension, searches and disciplinary interviews
  • Legal privilege boundaries when counsel directs investigative work
  • Data protection requirements for personal data, communications and surveillance records
  • Whistleblower protection measures and retaliation risk indicators
  • Jurisdictional advice required before cross-border evidence collection or disclosure

Participants can preserve, log and secure evidence for later review and challenge.

  • Evidence relevance, reliability, authenticity and sufficiency for investigative conclusions
  • Chain-of-custody logs recording possession, transfers, storage and access
  • Original documents, working copies and certified copies distinguished clearly
  • Evidence registers indexed by allegation, source, date and custodian
  • Secure storage controls for paper files, devices and digital media
  • ISO/IEC 27037 principles for identifying and preserving digital evidence

Participants can map transaction flows and identify records needed to test fraud hypotheses.

  • Source-to-pay records: requisitions, purchase orders, invoices and payment files
  • Order-to-cash records: contracts, deliveries, invoices, credits and collections
  • Payroll evidence: master data, timesheets, approvals and bank details
  • General ledger journals traced to source documents and authorisations
  • Bank statements reconciled with ledgers, payment runs and beneficiary data
  • Process maps locating handoffs, override points and missing audit trails

Participants can specify, obtain and prepare data for reproducible fraud analysis.

  • Data requests specifying fields, date ranges, formats and extraction owners
  • Read-only source extracts preserved before cleansing or transformation work
  • Data dictionaries documenting field definitions, codes and system limitations
  • Duplicate, missing and invalid records identified through profiling tests
  • Unique transaction identifiers created for linking multiple financial datasets
  • Reconciliation checks comparing extracted totals with approved financial reports

Participants can apply targeted analytical tests to identify transactions requiring investigation.

  • Benford's Law used cautiously to screen unnatural number distributions
  • Duplicate payment tests using invoice number, amount, date and supplier
  • Round-sum transactions analysed against approval limits and posting patterns
  • Weekend, holiday and after-hours postings tested for unusual activity
  • Split purchases identified below tender, quotation and approval thresholds
  • Exception populations documented with test logic, parameters and limitations

Participants can identify relationships and transaction patterns associated with collusion and conflicts.

  • Vendor master-file changes tested for duplicate addresses and bank accounts
  • Employee and supplier data matched using names, phones and addresses
  • Beneficial ownership checks identifying undisclosed related-party relationships
  • Procurement bid patterns analysed for rotation, cover bids and concentration
  • Conflict-of-interest declarations compared with procurement and payment records
  • Third-party due diligence files reviewed for gaps and inconsistencies

Participants can investigate journal entries and reporting adjustments that may distort financial statements.

  • Revenue recognition cut-off tested using contracts, deliveries and credit notes
  • Manual journals filtered by preparer, timing, description and account combinations
  • Management estimates challenged through assumptions, trends and subsequent outcomes
  • Capitalisation entries tested against expense policies and supporting invoices
  • Related-party transactions traced through disclosures, ledgers and ownership records
  • Ratio analysis identifies unexpected movements requiring source-document testing

Participants can test common asset theft and corruption schemes using relevant records.

  • Ghost employee indicators tested through payroll, attendance and identity records
  • Expense claim fraud assessed through receipts, mileage and duplicate submissions
  • Inventory shrinkage investigated using stock counts, adjustments and dispatch records
  • Cash lapping indicators traced across customer receipts and ageing reports
  • Bribery red flags reviewed in gifts, commissions and intermediary payments
  • Kickback patterns assessed through pricing, vendor selection and approval evidence

Participants can plan proportionate collection and review of relevant digital evidence.

  • Digital evidence sources include email, messaging, devices and system logs
  • Forensic images distinguished from ordinary copies and exported files
  • Search protocols define custodians, keywords, date ranges and exclusions
  • Metadata reviewed for creation, modification, authorship and access details
  • Email threading and timeline analysis reveal communication sequences
  • Digital evidence review documented without altering original source material

Participants can test documentary reliability and reconstruct events from multiple evidence sources.

  • Document provenance assessed through source, author, date and approval history
  • Version comparisons identify altered terms, deleted clauses and changed amounts
  • Chronologies integrate transactions, communications, approvals and physical events
  • Timeline gaps tested against system logs, calendars and witness accounts
  • Contradictory evidence recorded without prematurely dismissing alternative explanations
  • Link charts connect people, entities, accounts, transactions and communications

Participants can plan interviews that obtain reliable information while protecting the investigation.

  • Interview sequencing separates complainants, witnesses, subjects and corroborating sources
  • PEACE framework structures planning, engagement, account and closure stages
  • Question plans distinguish open, probing, clarifying and challenge questions
  • Known facts separated from assumptions before interviewing potential subjects
  • Disclosure strategy controls when documents and allegations are presented
  • Interview logistics address privacy, safety, language and recordkeeping requirements

Participants can conduct structured fact-finding interviews and create reliable interview records.

  • Rapport-building techniques establish purpose, process and interview ground rules
  • Free narrative accounts obtained before focused or challenge questioning
  • Cognitive interviewing prompts improve recall without suggesting answers
  • Inconsistencies explored through evidence-based questions and neutral phrasing
  • Contemporaneous notes distinguish direct statements, observations and investigator interpretations
  • Interview summaries capture admissions, denials, explanations and follow-up actions

Participants can calculate suspected losses and identify recovery evidence for management decisions.

  • Direct loss calculations trace payments, assets and fraudulent journal entries
  • Avoided costs and consequential losses separated from confirmed financial losses
  • Restitution schedules identify recipients, payment dates and recoverable amounts
  • Foreign exchange assumptions documented using transaction-date or reporting-date rates
  • Interest calculations state rates, periods, compounding and legal assumptions
  • Asset tracing links funds to accounts, property, vehicles and other holdings

Participants can draft a clear forensic report supported by evidence and proportionate conclusions.

  • Report structures separate mandate, procedures, facts, analysis and conclusions
  • Evidence references allow reviewers to locate underlying records quickly
  • Findings language distinguishes confirmed facts, reasonable inferences and unresolved issues
  • Standard-of-proof wording aligns with organisational policy and legal advice
  • Executive summaries state allegations, findings, losses and urgent actions
  • Quality reviews test factual accuracy, consistency, completeness and confidentiality

Participants can convert investigation findings into targeted fraud prevention and detection measures.

  • Root-cause analysis separates control design failures from operating failures
  • COSO Fraud Risk Management Guide applied to corrective action planning
  • Preventive controls address segregation, approvals, access and conflict declarations
  • Detective controls use reconciliations, exception reports and management review
  • Remediation plans assign owners, deadlines, evidence and validation methods
  • Residual fraud risks recorded after actions are implemented and tested

Participants can manage case progress and communicate appropriate information to stakeholders.

  • Case dashboards track allegations, evidence status, actions and decision points
  • Need-to-know communication plans protect confidentiality during active investigations
  • Board reporting distinguishes significant matters, trends and unresolved exposure
  • Regulator notification decisions informed by reporting duties and legal advice
  • Media and external communications coordinated through authorised spokespersons
  • Case closure protocols document decisions, retention periods and lessons learned

Participants can build, review and present a complete forensic audit case file for a suspected fraud matter.

  • Allegation assessment establishes scope, hypotheses, risks and investigation objectives
  • Investigation plan schedules evidence collection, analytics, interviews and governance
  • Transaction analysis identifies anomalies, linked parties and potential loss amounts
  • Evidence register demonstrates custody, relevance, reliability and source traceability
  • Forensic report presents findings, limitations, conclusions and corrective actions
  • Management presentation explains case decisions, evidence and remediation priorities

Exercises and examples are adapted to each cohort's sectors and roles.

What you take back to work

  1. Fraud allegation intake and triage template
  2. Risk-based investigation plan template
  3. Chain-of-custody evidence register
  4. Forensic transaction testing workbook
  5. PEACE interview planning and record template
  6. Forensic audit report and remediation action plan

Who should attend

  • Internal Auditors — assess and investigate suspected fraud beyond routine audit testing
  • Forensic Auditors — structure evidence-based examinations and defensible reporting
  • Compliance Managers — manage allegations, investigations and corrective action
  • Finance Managers — identify accounting manipulation and protect financial records
  • Risk Managers — translate investigation findings into fraud risk treatments
  • Legal and Investigations Staff — support fact-finding, evidence handling and case documentation

Skills and tools covered

Fraud case assessmentForensic transaction analysisEvidence managementInvestigative interviewingLoss quantificationForensic report writing

Tools and standards

ACFE Fraud Tree, COSO Fraud Risk Management Guide, Benford's Law, ISO/IEC 27037

How the course runs

Training methodology

The course uses short instructor briefings to introduce forensic methods, followed by case-based analysis of records, allegations and evidence. Participants work in groups on fraud scenarios involving procurement, payroll, expenses, revenue and third-party payments. Simulations develop allegation intake, interview preparation and findings communication. Facilitated reviews compare alternative investigative decisions, evidence sufficiency and report wording. Individual application planning helps participants adapt the course tools to their reporting lines, policies, systems and legal context.

Requirements and prerequisites

Participants should have working familiarity with accounting records, internal controls, financial transactions or audit evidence. Experience in internal audit, finance, compliance, risk, procurement, investigations or legal support is helpful. Participants should be comfortable reading general ledgers, invoices, bank records and basic management reports. Prior fraud investigation experience is not required, nor are specialist qualifications in law enforcement, digital forensics, data science or criminal law. The course explains investigation terminology and forensic methods before applying them to cases.

A typical training day

08:30 – 10:30First session
10:30 – 10:45Refreshment break
10:45 – 12:30Second session
12:30 – 13:30Lunch and networking
13:30 – 15:00Third session
15:00 – 15:15Refreshment break
15:15 – 16:30Workshop and daily review

Live online deliveries follow the same structure in East Africa Time, with shorter screen blocks and longer breaks.

What the fee includes

  • Instruction by a practitioner facilitator
  • Full course workbook and materials
  • Exercise files, templates and case studies
  • Refreshments and lunch on classroom deliveries
  • Certificate of completion
  • Post-course application plan

Frequently asked questions

Participants need familiarity with accounting records, financial transactions, controls or audit evidence. Previous fraud investigation work is helpful but not required, and the course does not assume law enforcement or digital forensics training.

Bring a laptop for working with course materials and, where permitted, a redacted example of an investigation challenge from your workplace. Do not bring confidential case files, personal data or evidence from active investigations.

It is designed for internal auditors, forensic auditors, finance managers, compliance staff, risk professionals, investigators and legal support staff. It also suits managers who commission investigations or review investigation findings.

Internal audit focuses on assurance over controls and governance, while this course focuses on establishing facts after a suspected fraud concern arises. Anti-money laundering training focuses on financial crime compliance, transaction monitoring and reporting obligations; this course addresses wider workplace fraud investigation methods.

Participants can use the allegation triage template, investigation plan, evidence register, analytics workbook and report structure on suitable internal cases. Local policies, legal advice and reporting requirements should always guide actual investigations.

Each training day runs from 08:30 to 16:30 and provides about 6.5 contact hours. The first part builds investigation foundations and accounting analysis skills; the later part covers interviews, reporting, remediation and a complete capstone case file.

Questions about this course?

Ask about dates, fees, group bookings or running it for your team. Our training team replies by email.