September 28, 2020

Documentation to meet the Burden of Proof

By Nicole McNeil Donecker, CPA, CVA, CAMS, Manager, Advisory Services

Documentation to meet the Burden of Proof Investigations, Forensic Accounting & Integrity Services

As forensic accountants, we can be engaged in civil or criminal matters, and some matters involve both. For example, we can be engaged to assist an entity in investigating a theft and then assist that same entity with civil litigation to recover the missing funds. While performing the investigation, we must remember that there is a different burden of proof for the criminal and civil aspects of the matter. How we document the loss and what is included in the loss will also differ.

When preparing the loss report and calculation, we need to keep in mind who will be relying on this information. In most theft investigations, the loss is first reported to law enforcement for criminal prosecution. In a criminal matter, the burden of proving the defendant’s guilt is on the prosecution, which must establish that fact “beyond a reasonable doubt.”

Burden of Proof

So what does “beyond a reasonable doubt” mean? It means the evidence presented only leads to the conclusion that the accused committed the crime. To meet that burden, the goal is to document each unauthorized disbursement made for the benefit of the accused individual, and not for the benefit of the entity. It should be clear that the unauthorized disbursement was directed by and for the benefit of the accused individual and not for the benefit of the entity. The documentation should enable a jury to conclude that those funds constituted an unauthorized disbursement to the accused individual. A criminal conviction could ultimately provide restitution or forfeiture of property to aid in making the victim whole, but that is not always the case.

The entity needs to find sources of recovery for the missing funds to make itself whole again. The first step is to determine if there is any insurance coverage such as a crime or fidelity policy that would cover some or all of the loss. The insurer or the insured could then look to the entity’s or the accused individual’s bank, the entity’s auditor/accountant, or the accused individual for recovery.

In civil cases, the plaintiff has the burden of proving the case by a “preponderance of the evidence.” A “preponderance of the evidence” means the plaintiff must convince the trier of fact that there is more than a 50% chance that the claim is true. Black’s Law Dictionary further states that the jury is instructed to find for the party that, on a whole, has the stronger evidence, however slight that edge may be.

Document, Document, Document

In proving the loss, the forensic accountant needs to document and support each transaction in question. The types of documents that can be used to document transactions are:

  • The entity’s bank statements, check copies, and any other bank documentation illustrating the disposition of the funds;
  • Credit card statements for the entity; and
  • If available, the bank statements, investment statements, and credit card statements for the accused individual.

Using the records available, all questionable transactions must be summarized and documented. For example, many questionable transactions identified are payments to a credit card. The entity may have a corporate credit card used by several employees for business purposes, but the specific payments in question were not be applied to the corporate credit card. Transfers to a bank account that the entity does not recognize are also discovered. The entity must determine if these transfers correspond to actual vendor payments.

To document questionable transactions, the forensic accountant uses the entity’s bank statement to show the funds leaving the bank account. The entity’s bank can provide additional information about the transactions identified on the bank statement. If law enforcement is already part of the investigation, they can issue subpoenas for the bank and credit card accounts that received payments. The bank and credit card statements can confirm the payments went to an account in the name of the accused individual and did not benefit the entity.

If the bank and credit card statements receiving the payment are not available, there are other ways to document the disposition of the funds with records available to the entity. Examples include:

  • If the entity has a policy requiring a credit check as part of employment and the ability to conduct credit checks on an ongoing basis, we can identify the credit card being paid from the credit report of the accused individual.
  • If the accused individual had previously submitted personal credit card receipts with an expense report, it can be determined if those receipts are for the same credit card being paid by the entity.
  • In cases where payroll is direct deposited for all employees, it can be determined if the account used for the direct deposit of the accused individual is the same account to which funds are being transferred on the bank statement.

All of the transactions and documentation used in the criminal matter will also be used for recovery in civil actions initiated by the entity. In addition, analysis is necessary to calculate possible other losses caused by the theft by the accused individual, which can include:

  • Bank overdraft charges:
  • Finance charges by vendors and corporate cards;
  • Tax penalties caused by late filings or payments;
  • Any payment made by the entity as a result the theft; and
  • Legal and other professional fees.


In closing, it is important to keep in mind who is relying on the report and documentation. In a criminal matter, can the jury conclude, based on the documents, that the accused individual misappropriated the funds for their personal benefit? During civil litigation can the trier of fact decide that there is more than a 50% chance that the entity’s claims are accurate?