Ricardo Gameroff
Managing Partner at Kreston BA Argentina
Suspected fraud: Knowing when to escalate
February 18, 2026
For most audit and tax partners, fraud does not appear as a formal engagement. It usually emerges in two ways.
First, through direct communication from the client. A CFO, CEO or board member expresses a concern, mentions irregularities, internal conflicts, missing information, or simply states that something does not seem right.
Second, through red flags identified during assurance or tax work. These typically include financial pressure on management to meet profitability targets or debt covenants; complex or highly subjective accounting estimates; weak governance or ineffective audit committee oversight; high turnover in finance or IT roles; inadequate segregation of duties; large volumes of cash or easily convertible assets; aggressive earnings forecasts; a culture that prioritizes results over controls; and management override signals such as unusual journal entries near period-end, inappropriate changes in estimates, fictitious vendors or employees, or unexplained transaction patterns.
In both cases, the partner is faced with the same situation: there is no proven fraud yet, but there are sufficient indicators to consider the risk seriously.
What ISA 240 says
ISA 240 defines the auditor’s responsibilities in relation to fraud in financial statement audits. Under the standard, auditors are required to identify and assess the risks of material misstatement due to fraud, design appropriate responses, and obtain reasonable assurance that the financial statements are free from material fraud-related misstatements. This includes procedures such as inquiries, evaluation of internal controls, analytical procedures and testing journal entries for fraud indicators.
However, ISA 240 also makes an important distinction. While auditors may identify or suspect fraud through these risk-based procedures, their objective is not to perform a forensic investigation or make a legal determination of fraud. Their role remains focused on obtaining sufficient and appropriate audit evidence for financial reporting purposes.
The revised ISA 240 (effective 2025) reinforces this approach by strengthening professional skepticism and the use of a “fraud lens” in risk assessment and audit responses, while maintaining the boundary between audit responsibilities and forensic or legal investigations.
Why fraud requires a different type of expertise
At that point, consulting a specialist is not a sign of weakness. It is a sign of professional judgment.
Certified Fraud Examiners (CFEs) are trained in areas that are not part of traditional accounting education, such as fraud schemes and behavioral patterns, evidence handling and preservation, interview techniques, digital forensics, legal and regulatory implications, and litigation support.
Most audit and tax partners are highly competent in financial and tax matters. Very few are trained to conduct forensic investigations. And that is perfectly normal. Fraud is a specialized discipline. Trying to handle a suspected fraud case without the appropriate expertise exposes both the client and the firm to unnecessary professional, legal and reputational risk.
Why forensic audits are different
A forensic investigation is fundamentally different from a financial or internal audit. A traditional audit focuses on whether financial information is fairly presented. A forensic audit focuses on whether misconduct occurred, how it happened, who was involved, what evidence exists, and what the legal consequences may be.
This requires different competencies, including investigation methodologies, digital forensic tools, interview and interrogation skills, chain of custody procedures, coordination with legal counsel, and documentation suitable for litigation or regulatory processes.
In other words, a forensic engagement is not an extension of audit procedures. It is a different type of professional service with its own standards, risks and technical requirements.
The priority in any fraud case: evidence preservation
Regardless of who leads the investigation, one principle always comes first: preserve the evidence. This includes both physical and digital evidence, such as accounting systems and databases, emails and files, servers and backups, access logs, and physical documentation.
Evidence must be secured before interviews, internal reviews or management actions take place. Once evidence is altered or destroyed, the case may become impossible to prove, regardless of how strong the initial suspicion was.
From a professional risk perspective, this is the most critical step in the entire process.
What to do in practice: the Kreston network
In many cases, audit and tax partners will identify fraud indicators but will not have the internal capabilities to conduct a full forensic investigation. This is where the Kreston network becomes a strategic advantage.
Through the global forensic expert network, Kreston firms can access Certified Fraud Examiners, forensic accountants, digital forensic specialists, cross-border investigation teams, and legal and regulatory coordination support.
The local firm remains the relationship owner. The forensic team provides the technical expertise. The network enables a coordinated, professional and defensible response.
Final message to partners
Fraud situations are unavoidable in professional practice. What makes the difference is not whether you encounter them, but how you respond when they arise. Knowing when to escalate, when to involve specialists, and how to protect evidence is not just good practice. It is part of your professional responsibility.
And when in doubt, the most valuable asset you have is the network.
