Financial Investigation Methods: Stages, Tools and Evidence

Financial investigation is the systematic reconstruction of how money moves — who paid whom, when and for what, where assets came from, and whether they match a person’s declared income. Unlike an audit or a state financial inspection, it does not ask whether the accounts were correctly prepared; it asks what actually happened to the money. What follows are the stages, methods and data sources I use in my forensic practice, together with the points a lawyer, an investigator or a business owner should keep in mind.

What a financial investigation is, and how it differs from audit and inspection

Three concepts are often confused, although they serve different purposes, answer to different clients and carry different legal consequences.

Feature	Audit	State inspection (revision)	Financial investigation
Purpose	Confirm that financial statements are reliable	Check the legality and completeness of operations	Establish the actual movement of funds and its link to people and events
Core question	”Do the statements meet the standards?"	"Was the proper procedure followed?"	"What actually happened to the money?”
Commissioned by	Owner, investor, bank	Regulator, management	Investigator, court, a party to proceedings, business
Output	Auditor’s report	Inspection act	Analytical material or an expert opinion

The key difference lies in the logic. An audit and an inspection move from documents to conclusion: they take the existing records and verify them. A financial investigation often moves the other way — from a suspicion or a hypothesis toward the documents that confirm or refute it. That is why it needs different tools: tracing transactions, building models, and cross-matching sources that are not officially connected to one another.

Stages of a financial investigation

Whether this is a pre-trial investigation or an internal business review, the structure of the work is similar.

1. Gathering and organising the information

At this stage a body of primary and derived data takes shape: bank statements, contracts, delivery notes, acts, payment orders, register data, tax reporting. It matters not only to collect the documents but to record their source and integrity — this is critical for an expert examination, because a document of unconfirmed origin is easy to challenge.

What to watch for:

• completeness of the period (gaps in statements distort the picture);
• agreement between the amounts in the primary documents and in the accounts;
• the presence of originals or properly certified copies.

2. Building a financial model

Scattered operations are brought together into a single structure: accounts, counterparties, periods, payment directions. The model shows how money enters and leaves, where it accumulates, and which intermediaries it passes through. In essence it is a map on which a specific route of funds can later be traced and atypical nodes identified — fictitious counterparties, circular payments, transit accounts.

3. Tracing the funds

Tracing — “follow the money” — is the step-by-step tracking of a specific sum from its source to the final recipient through a chain of transactions. The aim is to establish the link between an event (for example, receiving payment under a fictitious contract) and an asset (real estate, a corporate stake, cash). In practice the hardest part is not finding the first transaction, but not “losing” the money as sums are split and pushed through several counterparties.

4. Documenting the conclusion

The result must be reproducible: every statement rests on a specific document, every calculation can be repeated, and the methodology can be checked. When the material is prepared for court as an expert opinion, it is formalised according to the requirements of procedural law and the departmental instructions of the Ministry of Justice. An opinion documented without transparency loses its evidentiary force even when it is correct on the merits.

Methods for establishing the movement of funds

Bank flow analysis

The foundation of most investigations. Account statements are analysed by amounts, dates, payment purposes and counterparties. This reveals operations atypical for the business, regular transfers to related persons, cash withdrawals, transit schemes. The method’s strength is that it is factual — the bank records real operations; its weakness is that flows show movement but not always its economic substance, so they must be matched against contracts and primary documents.

Comparing declared and actual income

Here a person’s officially declared income is compared with their actual expenditure and the assets they have acquired. If, on their official income, a person could not realistically have bought the property they hold, a justified gap appears that calls for explanation. The method is widely used in cases on recognising assets as unjustified and in anti-corruption checks.

The net worth method

A classic indirect method. The logic is simple: the growth of a person’s net worth over a period, minus their documented legal income, equals the sum whose origin is unconfirmed. In outline:

• Net worth = all property and funds minus liabilities;
• Growth = net worth at the end of the period minus at the start;
• Undeclared income = growth plus expenditure minus confirmed legal receipts.

The method is powerful when there is no direct evidence of a specific sum moving, but it depends critically on the quality of the input data. An error in valuing the opening assets automatically distorts the whole result.

Data sources

A financial investigation relies on official registers and information holdings. In the Ukrainian context these are, above all:

• bank statements — the primary source on the movement of funds;
• YeDR — the Unified State Register of Legal Entities, Individual Entrepreneurs and Public Formations (ownership structure, directors, types of activity);
• DRRP — the State Register of Real Property Rights;
• NBU registers and open data — the National Bank of Ukraine’s information on financial institutions, official exchange rates and selected indicators;
• YeDRSR — the Unified State Register of Court Decisions (related disputes and facts established by courts);
• tax reporting data, customs data, vehicle registers.

Value emerges not from any single register but from matching them: when the movement of funds is overlaid on ownership structure, registered property and a person’s litigation history. At the same time, access to part of this data is restricted — banking secrecy and personal data are disclosed only in the manner provided by law, and this must be factored in at the planning stage.

The role of the forensic economic expert

When establishing the facts requires specialised economic knowledge, an expert examination is ordered in criminal proceedings — the grounds are set out in Article 242 of the Criminal Procedure Code of Ukraine (KPK). Economic examinations are carried out under separate expert specialities:

• 11.1 — examination of accounting and tax records and reporting;
• 11.2 — examination of documents on the economic activity of enterprises and organisations;
• 11.3 — examination of documents on financial and credit operations.

A forensic economic expert operates within the Law of Ukraine “On Forensic Expert Activity” and the Instruction on the ordering and conduct of forensic examinations and expert studies, approved by order of the Ministry of Justice of Ukraine No. 53/5. The expert’s task is not to “expose” anyone but to answer the questions put, objectively and impartially, within the materials provided. The expert does not gather evidence independently and does not go beyond their competence — assessing the legal qualification of an act remains with the investigator, the prosecutor and the court.

A financial and economic examination is ordered not only in criminal proceedings. The Commercial, Civil and Administrative procedure codes (HPK, TsPK, KASU) likewise allow the court to order an examination when resolving a dispute requires specialised economic knowledge, while tax control is exercised under the Tax Code of Ukraine. The methodology for studying the movement of funds is the same throughout — what differs is the procedural form and the range of questions asked. Within their respective powers, financial investigations are also handled by the Bureau of Economic Security (BEB), the State Tax Service (DPS), the State Financial Monitoring Service, and the National Agency on Corruption Prevention (NAZK).

Typical mistakes that devalue the result

Working without primary documents

The most common and most dangerous. You can build an impressive model on bank flows or register data alone, but without primary documents — contracts, delivery notes, acts — it remains a hypothesis. A payment purpose in a statement is what the payer wrote, not necessarily what actually happened. A conclusion that does not rest on primary documents is easy to refute in court.

False extrapolation

The second common error is extending a conclusion from a small sample to the whole period or volume. For example, overcharging is found on a few operations and the percentage is then mechanically multiplied across the entire turnover. This yields an impressive figure but is methodologically fragile: real operations are heterogeneous, and each episode needs its own confirmation. A cautious estimate backed by documents is always stronger than a large but assumed number.

The expert opinion as a source of evidence

In criminal proceedings the expert opinion is one of the procedural sources of evidence — it is named among them directly in Article 84 of the Criminal Procedure Code of Ukraine (KPK). But it carries evidentiary force only when it is complete, scientifically grounded and reproducible: built on reliable materials, with a transparent methodology and verifiable calculations. The court weighs it with no predetermined force, on equal footing with the other evidence. That is precisely why the quality of a financial investigation is measured not by the boldness of its conclusions but by the discipline of working with data at every stage — from collecting primary documents to the final report.

If you are a lawyer, an investigator or a business owner and need to assess the movement of funds, the soundness of assets, or the quality of an opinion already on file, it is wise to involve a forensic economic expert at an early stage. I would be glad to help make sense of your situation within the law and to prepare a well-grounded expert opinion.