What are the best techniques for a forensic accountant to use when conducting an investigative interview?

Conducting an investigative interview requires blending technical financial acumen with sharp behavioral observation. Effective forensic accountants use structured, strategic approaches to gather facts, test hypotheses, and uncover hidden narratives behind the numbers.

Essential techniques for conducting a successful forensic accounting interview include:

1. Thorough Preparation and Evidence Mapping
   • Review all relevant financial statements, bank records, tax filings, and emails before walking into the room.
   • Know the facts cold so you can spot inconsistencies, half-truths, or evasive answers in real time.
2. The Funnel Approach (General to Specific)
   • Start with low-threat, foundational questions regarding background, daily routines, and general job responsibilities to establish a comfort baseline.
   • Gradually transition to open-ended exploratory questions, and save narrow, sensitive, or high-risk financial inquiries for later in the interview.
3. Strategic Questioning and Pacing
   • Ask only one question at a time and address a single issue before moving on.
   • Master the "pregnant pause." Do not rush to fill silence; letting a moment linger often compels the interviewee to keep talking and reveal critical details.
4. Active Listening and Behavioral Observation
   • Pay close attention to changes in verbal tone, posture, eye contact, or defensive language when moving into sensitive financial topics.
   • Separate nervous reactions from potential indicators of deception, using documents to objectively verify anomalies rather than relying solely on gut feelings.
5. Using Documents as Leverage
   • Introduce specific evidence (e.g., a conflicting invoice, an unusual journal entry, or an authorized signature) methodically.
   • Frame inquiries around the documents ("Can you help me understand this transaction?") rather than launching direct accusations, which triggers defensiveness.
6. Controlled Documentation and Concluding Review
   • Keep meticulous notes—ideally utilizing a secondary team member for observation and documentation so the primary interviewer can maintain eye contact and rapport.
   • Conclude by summarizing key points, offering the interviewee a chance to clarify or add anything else, and keeping the door open for future communication.

Would you like to explore how to transition from a cooperative witness interview to a hostile suspect interview , or do you need help drafting specific financial probing questions for a case?

Forensic accounting interviews are most effective when treated as structured fact-finding exercises supported by financial evidence, rather than as confrontational interrogations. Recent forensic-interview guidance emphasizes preparation, precise questioning, corroboration, and avoiding contamination of the interview.

1. Prepare the evidence before the interview

A forensic accountant should know the financial records extremely well before questioning the subject:

• Identify the known facts, disputed facts, and unknowns.
• Map the suspected transaction flow: who initiated, approved, recorded, and benefited from each transaction.
• Understand relevant internal controls and how the accounting system works.
• Identify documents that corroborate or contradict the anticipated account.
• Develop a timeline of relevant transactions.
• Determine what information the interviewee is likely to know firsthand.

This preparation is particularly important because a poorly prepared interviewer can allow a subject to introduce doubt into supposedly established facts.

2. Start with information-gathering, not accusation

For witnesses and employees who may not be implicated, begin broadly:

“Walk me through your role in the purchasing process.” Then progressively narrow the questions:

“Who approves new vendors?” “What happens after approval?” “Who enters the invoice?” “How would you know if the vendor information changed?” This approach lets the accountant establish the person's knowledge, responsibilities, and version of events before introducing potentially incriminating evidence.

ACFE guidance recommends a non-threatening approach and generally working through procedural and background information before moving to sensitive fraud questions.

3. Use open-ended questions first

Questions such as:

• “Tell me what happened.”
• “Walk me through that transaction.”
• “How did you become involved?”
• “What happened next?”
• “Who else was involved?”

encourage the interviewee to provide their own narrative.

After obtaining the narrative, use specific, closed-ended questions to test individual facts:

“You said the invoice was approved on March 12. Who approved it?” A useful pattern is:

Open → clarify → narrow → test → corroborate.

A 2026 academic review similarly identifies interviews as useful for substantiating documentary/electronic evidence, identifying contextual information, and evaluating explanations of events.

4. Ask precise questions and define important terms

Avoid ambiguous terminology.

Instead of:

“Did you manipulate the accounts?” ask:

“Tell me about the $75,000 journal entry posted to account 6100 on June 30.” If the interviewee uses a potentially ambiguous term, ask:

“When you say ‘adjusted,’ what exactly did you do?” Recent ACFE guidance specifically recommends defining terms and establishing that interviewer and interviewee have the same understanding of important words.

5. Don't reveal all of your evidence too early

The interviewer generally shouldn't disclose everything known about the investigation at the outset.

For example, if you have bank records showing a payment went to a particular account, don't necessarily begin with:

“We know you transferred $50,000 to your personal account.” Instead, establish the person's understanding independently:

“Tell me about the $50,000 payment to ABC LLC.” Then progressively introduce the relevant evidence and ask the subject to explain discrepancies.

This gives you an opportunity to compare the person's account against evidence without prematurely supplying the answers.

6. Listen more than you talk

One of the biggest practical mistakes is asking a question and then filling the silence.

After asking:

“What happened to the $40,000?” stop talking.

Allow the subject time to formulate an answer. Follow-up questions should address what was actually said rather than simply moving through a predetermined script.

Also listen for:

• unexplained changes in terminology;
• answers that don't address the question;
• unexplained gaps in chronology;
• shifting explanations;
• references to documents or people you didn't previously know about;
• admissions embedded in otherwise innocent explanations.

These are investigative leads, not proof of deception.

7. Treat behavioral cues cautiously

An interviewee's nervousness, eye contact, posture, tone, or hesitation should not be treated as evidence that the person is lying.

The Journal of Accountancy recommends considering verbal and visual observations in the context of the entire evidence base and cautions against relying heavily on behavioral cues to detect deception.

The more defensible approach is:

Behavioral change → investigate the reason → corroborate with evidence.

For example, if the subject suddenly becomes hesitant when discussing a particular transaction, don't conclude “they're lying.” Instead ask additional factual questions about that transaction.

8. Use the subject's own words

If someone says:

“I moved the money because the vendor wasn't legitimate.” Don't immediately reinterpret that as “you stole the money.”

Follow up:

“What do you mean by ‘moved’?” “Where did you move it?” “Who authorized that?” “What did you mean when you said the vendor wasn't legitimate?” This can produce considerably more useful evidence than imposing your own terminology.

9. Reconcile the interview with the accounting records

This is where the forensic accountant has an advantage over a general interviewer.

For every significant explanation, ask:

Does the accounting evidence support it?

For example:

The interview should generate testable propositions, rather than being treated as the evidence itself.

10. Separate witnesses from suspects

A witness interview and a suspect interview have different objectives.

For a witness, the primary objective is usually information gathering and corroboration.

For a suspect, the interviewer may eventually need to confront specific discrepancies or seek an explanation/admission—but only after adequate preparation and development of the factual record.

ACFE specifically distinguishes admission-seeking interviews and recommends reserving that approach for situations where the subject's involvement has been sufficiently established.

11. Avoid contamination

Interview contamination occurs when the interviewer inadvertently influences the person's account.

Examples include:

• revealing facts unnecessarily;
• suggesting the expected answer;
• asking leading questions too early;
• telling the witness what another person supposedly said;
• repeatedly interrupting;
• allowing multiple witnesses to discuss their accounts before interviewing them.

ACFE's current guidance emphasizes planning specifically to minimize contamination and avoiding question structures that allow the subject to evade the factual issue.

12. End with a broad opportunity to add information

After you've covered the substantive issues, ask something like:

“Is there anything else about these transactions that you think I should know?” or:

“Is there anything we haven't discussed that would help me understand what happened?” Then wait.

This can produce additional information that wasn't elicited by your prepared questions. Experienced fraud examiners specifically describe this kind of closing question as a useful way to uncover unexpected information.

13. Document the interview meticulously

The final work product should make it possible for another investigator, counsel, auditor, or expert to understand:

• who was interviewed;
• when and where;
• who was present;
• what information was requested;
• what the person said;
• what documents were referenced;
• significant admissions or denials;
• inconsistencies requiring follow-up;
• investigative leads generated by the interview.

ACFE's fraud-examination framework explicitly includes interview planning, documentation, question sequencing, interviewee rights, rapport, resistance, and closing as core interview competencies.

A useful overall framework

For a forensic accountant, I would structure the interview process as:

Prepare → establish rapport → obtain the person's narrative → clarify → narrow to specific transactions → test against evidence → explore discrepancies → corroborate → give the person an opportunity to explain → close and document.

The central principle is don't try to “catch” someone in the interview. Your objective is to obtain reliable information that can be independently corroborated by the financial, electronic, and documentary evidence. That produces a much stronger forensic conclusion than relying on an apparent confession, demeanor, or a single inconsistent answer.

For formal investigations, applicable employment, privacy, recording-consent, privilege, and jurisdiction-specific legal requirements should also be addressed with appropriate counsel before conducting the interview.

The final work product should make it possible for another investigator, counsel, auditor, or expert to understand:

“What do you mean by ‘moved’?” “Where did you move it?” “Who authorized that?” “What did you mean when you said the vendor wasn't legitimate?” This can produce considerably more useful evidence than imposing your own terminology.

9. Reconcile the interview with the accounting records

This is where the forensic accountant has an advantage over a general interviewer.

For every significant explanation, ask:

Does the accounting evidence support it?

For example:

The interview should generate testable propositions, rather than being treated as the evidence itself.

10. Separate witnesses from suspects

A witness interview and a suspect interview have different objectives.

For a witness, the primary objective is usually information gathering and corroboration.

For a suspect, the interviewer may eventually need to confront specific discrepancies or seek an explanation/admission—but only after adequate preparation and development of the factual record.

ACFE specifically distinguishes admission-seeking interviews and recommends reserving that approach for situations where the subject's involvement has been sufficiently established.

7. Treat behavioral cues cautiously

An interviewee's nervousness, eye contact, posture, tone, or hesitation should not be treated as evidence that the person is lying.

The Journal of Accountancy recommends considering verbal and visual observations in the context of the entire evidence base and cautions against relying heavily on behavioral cues to detect deception.

The more defensible approach is:

Behavioral change → investigate the reason → corroborate with evidence.

Forensic accounting interviews are most effective when they are treated as evidence-gathering exercises rather than confrontational interrogations. The goal is to obtain accurate, detailed, corroborated information while preserving the credibility of the investigation.

1. Prepare thoroughly before the interview

A strong interview usually starts with the financial analysis, not the first question.

• Review the relevant general ledgers, bank statements, journal entries, invoices, contracts, emails, expense reports, payroll records, and other evidence.
• Identify anomalies and formulate hypotheses—but don't become committed to one explanation too early.
• Determine what you already know, what you need to establish, and what only the interviewee can explain.
• Establish an interview sequence. ACFE guidance generally favors interviewing less-involved or neutral witnesses before people who may be implicated.
• Prepare a question outline rather than a rigid script. AICPA & CIMA specifically emphasizes planning who to interview, the key points to cover, and the sequence.

Key principle: Know the evidence well enough that you can recognize an important answer when you hear it.

2. Use a structured investigative-interview framework

The P.E.A.C.E. model is particularly useful:

1. Planning and preparation
2. Engage and explain
3. Account — obtain the person's account, then clarify and challenge inconsistencies
4. Closure
5. Evaluation

The approach emphasizes obtaining accurate, relevant and complete information rather than simply extracting a confession. ACFE notes that this approach has increasingly been used as an alternative to heavily confession-oriented interrogation techniques.

3. Start broad, then become specific

One of the most valuable techniques is progressive narrowing.

Instead of:

"Did you authorize the $85,000 payment to XYZ?" start with:

"Walk me through how payments to XYZ were normally processed." Then:

"Who was involved?" "What documentation was required?" "How did you become involved?" Only later introduce the specific transaction.

This lets you obtain the interviewee's unprompted account before exposing all the information you possess.

4. Favor open-ended questions

Good investigative questions encourage narration:

• "Tell me about your responsibilities in the purchasing process."
• "Walk me through what happened."
• "How did you become aware of that?"
• "What happened next?"
• "Who else would have knowledge of this?"
• "What records would help us verify that?"

Then use focused questions to pin down details:

• "What date was that?"
• "Which account was used?"
• "Who approved it?"
• "Approximately how much was involved?"
• "What documentation was created?"

ACFE describes informational interviews as generally moving through open, closed and, where appropriate, more focused questions.

5. Let silence work for you

Don't immediately fill pauses.

After asking:

"Is there anything else you remember about that transaction?" wait.

People frequently continue talking when the interviewer doesn't rush to the next question. ACFE practitioners specifically emphasize the value of waiting and using broad closing questions to uncover unexpected information.

6. Establish a baseline—but don't rely on body language alone

Pay attention to:

• Changes in speaking pace
• Unusual hesitation
• Changes in level of detail
• Sudden defensiveness
• Inconsistencies
• Unusual qualifiers such as "I don't really remember"
• Changes in terminology or certainty

But don't conclude that someone is lying simply because they avoid eye contact, fidget, cross their arms, or display nervousness. Nervousness has many explanations.

AICPA & CIMA and ACFE both recognize verbal and nonverbal behavior as areas interviewers should understand, but the stronger forensic approach is to use behavioral observations as indicators for further questioning, not as proof of deception.

7. Ask the interviewee to explain discrepancies

This is especially powerful for forensic accountants.

Suppose the records show:

• Employee says: "I never approved the payment."
• Email shows the employee approved it.
• Accounting system shows the employee's credentials were used.

Don't immediately say:

"You're lying. Here's the email." Instead:

"Help me understand this email. It appears that you approved the payment here. What was happening at the time?" This gives the person an opportunity to provide an explanation while allowing you to assess it against the documentary evidence.

8. Use evidence strategically

Don't disclose everything you know at the beginning.

If you reveal every piece of evidence immediately, you may prevent the interviewee from providing an independent account and give a knowledgeable subject an opportunity to tailor their explanation.

A useful progression is:

Unprompted account → clarification → specific transaction → documentary evidence → explanation of inconsistency.

The objective isn't to "trap" someone. It's to compare their account against independently obtained evidence.

9. Use the interviewee's own terminology

If someone calls a payment a "rebate," don't immediately substitute "kickback."

Ask:

"When you say 'rebate,' what exactly do you mean?" This is particularly important in financial investigations because seemingly ordinary terms—"commission," "consulting fee," "bonus," "rebate," "advance," "loan," etc.—can have very different meanings.

10. Follow the money with "who, what, when, where, why and how"

Forensic accounting interviews should translate narratives into testable financial facts.

For each important transaction, establish:

• Who initiated it?
• Who approved it?
• Who benefited?
• What was purchased or transferred?
• When did it occur?
• Where did the money go?
• How was the transaction executed?
• Why was it supposedly legitimate?
• What records should exist?
• Who else can corroborate the account?

That converts an interview answer into something that can be independently verified.

11. Separate facts from assumptions

Ask the interviewee to distinguish between what they:

• personally saw,
• personally did,
• were told by someone else,
• inferred,
• or merely assumed.

For example:

"How do you know the vendor performed the work?" followed by:

"Did you personally observe the work?" and:

"Who told you it had been completed?" This can expose weaknesses in an apparently credible explanation.

12. Don't unnecessarily confront the person

A confrontational style can cause the interviewee to become defensive, shut down, or simply tell you what they think you want to hear.

A better approach is often calm curiosity:

"I'm trying to reconcile these two pieces of information. Help me understand how they fit together." That preserves rapport while still putting inconsistencies directly on the table.

13. Adapt to the interviewee

A CFO, bookkeeper, vendor, employee, whistleblower and fraud victim require different approaches.

For victims and vulnerable witnesses in particular, ACFE recommends trauma-informed practices such as allowing pauses, using open-ended questions, avoiding blame-oriented language, and giving the person appropriate autonomy.

14. Close with broad questions

Don't end immediately after getting the answer to your final planned question.

Useful closing questions include:

• "What haven't I asked you that I should have?"
• "Is there anything you think I've misunderstood?"
• "Who else should I speak with?"
• "What records should I review?"
• "Is there anyone else who can corroborate what you've told me?"
• "Is there anything else you want to tell me?"

That last question has been specifically highlighted by experienced fraud examiners as a potentially productive way to uncover information that hadn't surfaced earlier.

15. Document and evaluate immediately afterward

After the interview, document:

• material statements,
• admissions,
• denials,
• inconsistencies,
• names and entities mentioned,
• documents identified,
• follow-up investigative leads,
• your observations,
• and questions that remain unanswered.

Then compare the account against the documentary and financial evidence. AICPA & CIMA identifies interviewing as an important evidence-gathering technique and emphasizes the legal considerations surrounding interviews in forensic engagements.

A practical formula

A good forensic accounting interview can be thought of as:

Prepare → Build rapport → Obtain an uninterrupted account → Clarify → Test against evidence → Explore discrepancies → Identify corroboration → Close broadly → Evaluate.

The biggest mistake is trying to win the interview. The forensic accountant's objective is to obtain information that is accurate, independently testable, and defensible if the investigation eventually reaches litigation or testimony. ACFE and AICPA & CIMA both treat interviewing as a core investigative skill rather than simply a technique for obtaining admissions.

"When you say 'rebate,' what exactly do you mean?" This is particularly important in financial investigations because seemingly ordinary terms—"commission," "consulting fee," "bonus," "rebate," "advance," "loan," etc.—can have very different meanings.

10. Follow the money with "who, what, when, where, why and how"

Forensic accounting interviews should translate narratives into testable financial facts.

For each important transaction, establish:

• Who initiated it?
• Who approved it?
• Who benefited?
• What was purchased or transferred?
• When did it occur?
• Where did the money go?
• How was the transaction executed?
• Why was it supposedly legitimate?
• What records should exist?
• Who else can corroborate the account?

That converts an interview answer into something that can be independently verified.

11. Separate facts from assumptions

Ask the interviewee to distinguish between what they:

• personally saw,
• personally did,
• were told by someone else,
• inferred,
• or merely assumed.

For example:

"How do you know the vendor performed the work?" followed by:

"Did you personally observe the work?" and:

"Who told you it had been completed?" This can expose weaknesses in an apparently credible explanation.

12. Don't unnecessarily confront the person

A confrontational style can cause the interviewee to become defensive, shut down, or simply tell you what they think you want to hear.

A better approach is often calm curiosity:

"I'm trying to reconcile these two pieces of information. Help me understand how they fit together." That preserves rapport while still putting inconsistencies directly on the table.

13. Adapt to the interviewee

A CFO, bookkeeper, vendor, employee, whistleblower and fraud victim require different approaches.

For victims and vulnerable witnesses in particular, ACFE recommends trauma-informed practices such as allowing pauses, using open-ended questions, avoiding blame-oriented language, and giving the person appropriate autonomy.

14. Close with broad questions

Don't end immediately after getting the answer to your final planned question.

Useful closing questions include:

Conducting an investigative interview as a forensic accountant requires a blend of financial acumen and sharp psychological strategy. The goal isn't just to extract a confession, but to secure verifiable facts and pin down inconsistencies.

• Active listening and observation: Pay close attention to verbal and non-verbal cues, noting when a subject shifts from open to defensive, particularly when specific financial transactions or documents are introduced.
• Document-anchored questioning: Introduce financial evidence, emails, or ledgers strategically—often starting with benign background documents before moving to anomalous or fraudulent transactions to lock the subject into a narrative.
• Establishing baseline behavior: Ask comfortable, neutral background questions early on to gauge the subject's normal communication style, posture, and tone before diving into high-stress financial topics.
• Open-ended inquiry: Use broad, open-ended questions initially (e.g., "Walk me through the approval process for this vendor") to let the subject talk freely, which often reveals unintended admissions or contradictions.
• Cognitive interviewing techniques: Encourage the subject to recall events from different perspectives or in reverse chronological order to disrupt rehearsed scripts and expose fabrications.
• Strategic silence: Allow deliberate pauses after asking a tough question; discomfort often compels the subject to keep talking and fill the silence with valuable information.

Would you like me to expand on how to structure the interview phases or how to handle a hostile witness during a financial investigation?

Forensic accounting interviews are most effective when treated as structured fact-finding exercises, not interrogations. The goal is to obtain reliable information, identify inconsistencies, develop evidence, and—where appropriate—obtain admissions. AICPA and ACFE materials emphasize preparation, question design, communication, and careful sequencing.

Best techniques

1. Prepare thoroughly before the interview

• Understand the allegation, accounting records, transactions, timeline, and people involved.
• Review relevant bank statements, journal entries, invoices, emails, system logs, contracts, and prior statements.
• Identify what you know, suspect, and still need to establish.
• Prepare an interview outline, but remain flexible when new information emerges.

2. Interview witnesses before suspects

• Where practical, begin with neutral or corroborating witnesses and work toward people who may have greater involvement.
• This helps establish the facts and evidence before approaching a potentially implicated individual.

3. Establish rapport without becoming overly familiar

• Start with straightforward, non-threatening questions about the person's role, responsibilities, and relevant processes.
• Let the person talk.
• Demonstrate genuine interest and listen rather than rushing to the next question.
• Rapport should facilitate communication, not manipulate the interviewee.

4. Start with open-ended questions Questions such as:

• “Walk me through how that process normally works.”
• “Tell me what happened.”
• “Describe your responsibilities for the account.”

Open questions encourage the interviewee to provide information in their own words and can reveal facts you didn't anticipate. ACFE describes informational interviewing as progressing from open questions toward more focused questions. ACFE 5. Then progressively narrow the questions

A useful progression is:

Open → specific → closed → documentary confrontation

For example:

• “Tell me about the payment process.”
• “Who could authorize payments?”
• “Who authorized the payment to ABC Ltd.?”
• “Did you authorize the $25,000 payment on March 14?”
• “Here's the authorization record showing your credentials. Help me understand what happened.”

This approach lets you obtain the interviewee's account before introducing contradictory evidence. 6. Use precise, unambiguous language

Avoid vague questions such as:

“What do you think happened?” Prefer:

“What happened when the $50,000 transfer was initiated?” Define potentially ambiguous accounting or business terms. For example, don't assume that you and the interviewee mean the same thing by “approved,” “authorized,” “cash,” or “related party.” Recent ACFE guidance particularly emphasizes precise wording and avoiding questions that allow the subject to evade the issue through interpretation.

7. Ask one question at a time

Avoid compound questions such as:

“Did you prepare the invoice, approve it, and send it to the bank?” Instead:

• “Did you prepare the invoice?”
• “Did you approve it?”
• “Did you send it to the bank?”

This makes the answers easier to understand and document. 8. Use silence effectively

After asking a good question, wait. People frequently fill uncomfortable silence with additional information. Don't rescue the interviewee by immediately rephrasing the question. 9. Listen for explanations, not just admissions

In financial investigations, seemingly minor details can be extremely valuable. Pay attention to:

• Who had access?
• Who knew about the transaction?
• Who benefited?
• Who instructed whom?
• What was the normal procedure?
• What happened differently this time?
• Who else can corroborate the explanation?

10. Use documents strategically

Don't necessarily reveal all your evidence at the beginning. First obtain the interviewee's independent account. Then introduce relevant documents and ask them to explain them.

For example:

“You said you never had access to the account. Here's the access log showing your credentials were used at 9:14 p.m. on that date. Explain what happened.” The objective is to give the person an opportunity to explain the evidence—not simply to announce that you've caught them.

1. Test inconsistencies carefully

If an answer conflicts with another statement or financial record, don't immediately accuse the person of lying.

Try:

“Earlier you said X. The bank records appear to show Y. Help me reconcile those two things.” This can produce substantially more information than an aggressive accusation.

1. Separate assessment from admission-seeking

ACFE distinguishes among introductory, informational, assessment, closing, and admission-seeking questions. Assessment and admission-seeking techniques should be used only when the evidence warrants moving beyond routine fact gathering.

In particular, don't treat every nervous witness as a fraudster. A person's demeanor is not proof of deception.

1. Be cautious about body language

Changes in tone, pace, posture, eye contact, or other behavior can tell you that an answer deserves further exploration, but they shouldn't be treated as standalone proof of deception. Establishing a person's normal communication pattern early in the interview can make deviations more meaningful.

1. Close with broad questions

Don't end immediately after getting the answer to your final planned question. Ask:

• “What else should I know?”
• “Who else should I speak with?”
• “Are there documents I should review?”
• “Is there anything we've discussed that you want to clarify?”
• “Is there anything else you want to tell me?”

Sometimes the most important information emerges at the end of an interview.

1. Document the interview meticulously

Record:

• Date, time, location, and participants
• Questions and substantive answers
• Documents shown
• Significant inconsistencies
• Follow-up issues
• Names of additional witnesses
• Commitments to provide documents or information

Follow applicable legal, organizational, and engagement requirements concerning recording, consent, confidentiality, privilege, and preservation of evidence.

A practical interview structure

A strong forensic-accounting interview might look like this:

1. Introduction Explain who you are, the general purpose of the interview, and the ground rules.

2. Background Establish role, responsibilities, relationships, systems access, and relevant experience.

3. Free narrative “Tell me how the process worked.”

4. Detailed chronology Work through events sequentially—who, what, when, where, how, and why.

5. Transaction-specific questions Drill into particular payments, journal entries, accounts, vendors, customers, or adjustments.

6. Evidence testing Introduce documents and reconcile the interviewee's account with the evidence.

7. Inconsistencies and gaps Give the interviewee an opportunity to explain discrepancies.

8. Additional leads Ask who else knows, what records exist, and what other transactions should be examined.

9. Closing Give the interviewee an opportunity to add or correct information.

The key principle is progressive disclosure: learn the person's account first, develop the facts second, test that account against evidence third, and reserve confrontational or admission-seeking questions for situations where the evidence justifies them. This is consistent with the structured interview methodology described by ACFE and the forensic-interview guidance offered by AICPA.

If you're training forensic accountants, a particularly useful next step is to build a fraud-investigation interview question bank organized by allegation type—embezzlement, financial-statement fraud, procurement fraud, payroll fraud, related-party transactions, and money laundering.

Conducting an investigative interview as a forensic accountant requires a blend of technical financial acumen and psychological insight . Unlike standard audits, these interviews often involve uncooperative, defensive, or deceitful subjects.

Here are the best techniques for mastering the forensic interview process:

• 1. Prepare thoroughly with a detailed financial profile
     Never walk into an interview without knowing the numbers cold. Reconstruct the financial reality, anomalies, and transaction trails beforehand so the subject realizes you cannot be easily misled by vague explanations or technical jargon.
• 1. Employ the "Inverted Pyramid" structure
     Start broad and non-threatening before narrowing down to specific, incriminating topics. Begin with background questions, move to routine business practices, transition to general control weaknesses, and finally focus on the specific suspicious transactions or discrepancies.
• 1. Ask open-ended, non-accusatory questions early on
     Allow the subject to talk freely during the initial phases. Open-ended questions (e.g., "Walk me through the approval process for this vendor" vs. "Did you approve this invoice?" ) encourage subjects to commit to a narrative, leaving room to catch inconsistencies later.
• 1. Use silence strategically
     After asking a direct, difficult question, remain silent. Inexperienced interviewers rush to fill the silence out of discomfort, but subjects often feel compelled to break the silence themselves—frequently offering damaging admissions or over-explaining.
• 1. Observe verbal and non-verbal behavioral clusters
     Watch for shifts in baseline behavior. Look for clusters of indicators (such as sudden changes in posture, defensive language, grooming gestures, or shifts from casual to rigid phrasing) rather than relying on a single "tell" for deception.
• 1. Confront with evidence progressively
     Do not reveal your entire deck of evidence at once. Introduce documents and exhibits incrementally—starting with neutral or corroborating documents and moving gradually toward the definitive proof of the irregularity.
• 1. Maintain control of the psychological environment
     Keep the tone professional, calm, and objective. Never display anger, judgment, or personal triumph when a contradiction is exposed. A calm demeanor keeps the subject off-balance and prevents them from shifting into an aggressive or defensive posture.

Would you like me to dive deeper into how to handle a hostile subject or explore document-based confrontation tactics?

Conducting an investigative interview as a forensic accountant requires a blend of rigorous financial preparation and nuanced behavioral psychology. Unlike regular audits, these interviews often involve uncooperative, defensive, or deceitful subjects.

Here are the best techniques used by forensic accountants to extract critical information:

1. The "Honest Accountant" (Non-Confrontational) Approach
   • Start with a soft, non-threatening posture. Frame yourself as someone simply trying to "reconcile the numbers" or "understand the discrepancies" rather than an investigator hunting for a criminal. This lowers the subject’s psychological defenses and encourages them to talk.
2. Strategic Question Sequencing (The Funnel Method)
   • Introductory phase: Establish rapport, set the ground rules, and ask benign, easy-to-answer background questions to baseline the subject's normal verbal and non-verbal behavior.
   • Informational phase: Move to open-ended questions about processes, controls, and daily workflows without implying fault.
   • Assessment phase: Ask targeted, specific questions about the anomalies or documents you have uncovered.
   • Closing phase: Summarize and confirm statements, leaving the door open for them to clarify or add information later.
3. Mastering the Power of Silence
   • After asking a difficult or high-stakes question, stop talking. Do not rush to fill the silence, even if it feels uncomfortable. Guilty or stressed subjects will often feel compelled to break the silence, frequently over-explaining or revealing details you hadn't even asked for yet.
4. Document-Centric Questioning
   • Let the physical evidence do the heavy lifting. Instead of asking, "Did you forge this invoice?" place the document in front of them and ask, "Can you walk me through the approval chain on this specific entry?" or "How did this variance occur?" This forces them to address the hard evidence rather than your accusations.
5. Observing Behavioral Baselines and Shifts
   • Pay close attention to changes in the subject’s baseline behavior. Watch for sudden shifts in posture, grooming gestures, changes in vocal pitch or speech rate, and defensive shielding (like crossing arms or placing objects between themselves and the interviewer) when transitioning from routine questions to financial discrepancies.
6. Avoiding Premature Accusations
   • Never back a suspect into a corner too early with definitive accusations of fraud. If they feel trapped and commit to a false denial early in the interview, it becomes exponentially harder for them to pivot and confess later without losing face.

If you'd like, I can dive deeper into:

• How to structure an interview outline for a specific type of fraud (like embezzlement or asset misappropriation)
• Specific verbal cues and red flags to listen for
• Tips for handling hostile or aggressive subjects

Let me know how you'd like to proceed!

For a forensic accountant, the strongest investigative interviews are fact-finding exercises supported by accounting evidence, not simply attempts to obtain a confession. The ACFE emphasizes preparation, question structure, rapport, careful evaluation of responses, and ethical interviewing.

1. Prepare the evidence before the interview

Build a clear chronology and understand the financial mechanics before sitting down with the interviewee.

• Identify the who, what, when, where, how, and how much of the suspected scheme.
• Reconcile relevant bank accounts, journals, invoices, expense reports, payroll, vendor records, emails, and system logs.
• Identify discrepancies that you can explain in simple terms.
• Separate known facts, reasonable inferences, and unresolved questions.
• Decide what evidence you will disclose and what you will hold back.
• Develop an interview outline, but remain flexible if the subject introduces new information. ACFE specifically recommends detailed preparation while cautioning against becoming so tied to the outline that you miss important avenues of inquiry.

A useful goal is to walk into the interview knowing which questions you need answered—not necessarily which conclusion you want confirmed.

2. Start with rapport and neutral questions

Don't begin with, "We know you stole the money."

Start with straightforward questions about the person's role, responsibilities, processes, and knowledge:

• "Describe your responsibilities in accounts payable."
• "Walk me through how a new vendor gets created."
• "Who normally approves payments?"
• "Tell me about your involvement with this account."

This establishes rapport while also giving you a baseline for how the person communicates. ACFE identifies introductory questions as a way to establish rapport, gain cooperation, and observe the respondent's reactions.

3. Use open-ended questions first

One of the most effective techniques is to let the person provide their own account before confronting them with specific evidence.

For example:

"Walk me through everything that happened with the $75,000 payment." Then follow up with:

"What happened next?" "Who else was involved?" "How did you know what to do?" "What records would document that?" This can reveal information you didn't anticipate and gives you a statement against which you can later compare documentary evidence.

ACFE recommends progressing from general fact-gathering toward more specific questioning rather than immediately becoming confrontational.

4. Drill down from broad answers to precise facts

A common mistake is accepting vague answers such as "I don't remember" or "That's how we normally did it."

Break the answer into components:

Who? → What? → When? → Where? → How? → Why? → What evidence?

For example:

• "You said John approved it. What specifically did John do?"
• "When did that occur?"
• "How did you communicate with him?"
• "Was that by email, phone, or the accounting system?"
• "Where would I find the record?"
• "Who else would have knowledge of that?"

This is particularly powerful for forensic accountants because vague verbal assertions can often be tested against transactional evidence.

5. Define important terms

Be careful with words such as "authorized," "approved," "personal," "loan," "reimbursement," "vendor," "cash," "altered," and "embezzled."

Different people can interpret the same term differently. Recent ACFE guidance specifically recommends ensuring that interviewer and interviewee share the same understanding of important terms and asking the subject to clarify what they mean.

Instead of:

"Was the payment authorized?" Ask:

"What do you mean by 'authorized'?" Then:

"Who gave the authorization, when, and how?" That produces a much more defensible factual record.

6. Use the accounting evidence strategically

Don't dump all your evidence on the table at once.

Suppose you discover:

• Employee A created a vendor.
• Employee A approved an invoice.
• Employee A changed the vendor's bank account.
• The payment went to an account associated with Employee A.

You might initially ask:

"Tell me everything you know about this vendor." Then progressively narrow the inquiry:

"Who created the vendor record?" "What was your role in creating it?" "Who changed the bank information?" "How did you know the bank information needed to be changed?" Only after establishing the person's account should you introduce the contradictory documentation.

This allows you to distinguish what the person voluntarily knows and says from what they say only after seeing the evidence.

7. Use contradiction testing carefully

When the interviewee gives an account inconsistent with the records, don't immediately say, "That's a lie."

Instead:

"You said the payment was approved by Sarah. Let's look at the approval record. Help me understand what I'm seeing here." Then allow them to explain the discrepancy.

Follow with:

"Earlier you said X. Now you're saying Y. Help me understand the difference." The objective is to give the person an opportunity to explain inconsistencies while creating a clear record of the discrepancy.

The PEACE interviewing approach similarly emphasizes clarification and challenge while focusing on obtaining reliable information rather than simply pursuing a confession.

8. Don't overinterpret body language

Sweating, avoiding eye contact, nervousness, pauses, changes in tone, or fidgeting aren't proof of deception.

They can indicate stress, confusion, fear, or many other things.

Instead, treat behavioral changes as prompts for additional questions:

"I noticed you've become hesitant when we got to this transaction. Is there something about it you'd like to clarify?" ACFE's current interviewing material also cautions investigators to recognize their own biases and avoid drawing conclusions from nonverbal behavior without exploring the reason for it.

9. Maintain strategic silence

After asking an important question, stop talking.

For example:

"Did you transfer the $40,000 to that account?" Then wait.

Investigators sometimes become uncomfortable with silence and start explaining or modifying their question. That can give the interviewee an escape route.

A calm pause often encourages the person to elaborate voluntarily.

10. Ask the subject to explain the evidence

Some of the most useful questions for a forensic accountant are simple:

• "Explain this transaction."
• "Why was this entry made?"
• "Who instructed you to make it?"
• "Why was the entry posted on that date?"
• "Why does the supporting document say something different?"
• "Who had access to this account?"
• "How would someone have been able to make this change?"
• "What legitimate business purpose did this payment have?"
• "What records would prove your explanation?"

The last question is especially useful because it turns the interview into a roadmap for corroboration.

11. Work from neutral witnesses toward subjects

Don't necessarily interview the suspected perpetrator first.

A useful sequence is:

documents/data → neutral witnesses → knowledgeable witnesses → potentially involved employees → primary suspect

ACFE describes fraud examinations as moving from individuals least likely to be involved toward those more likely to be involved, allowing the investigator to develop information before conducting more difficult interviews.

This also reduces the chance that a suspect learns what investigators already know.

12. Close by asking for anything you've missed

Don't finish immediately after your final substantive question.

Ask:

"Is there anything else about this transaction that you think I should know?" Then:

"Who else should I speak with?" "What records should I review?" "Is there anything I've misunderstood?" "Is there anything you would like to correct or add to your answers?" ACFE specifically identifies closing questions as an opportunity to reconfirm facts, uncover previously undiscovered information, and identify additional evidence.

13. Document the interview meticulously

The interview record should distinguish:

• What the interviewee said
• What documents show
• What the investigator observed
• What the investigator inferred

Avoid converting an interviewee's statement into an investigator's conclusion.

For example, document:

"The subject stated that John approved the payment." rather than:

"John approved the payment." unless independent evidence establishes the latter.

Also preserve relevant exhibits, timestamps, notes, recordings where legally permissible, and any written statement.

A practical interview structure

For a suspected financial fraud, I'd use this sequence:

1. Preparation — understand the transactions and evidence.
2. Introduction/rapport — establish purpose and neutral baseline.
3. Free narrative — "Tell me what happened."
4. Process questions — establish how the accounting process normally works.
5. Specific transaction questions — who, what, when, where, how.
6. Clarification — define ambiguous terms and resolve vague answers.
7. Evidence testing — introduce relevant documents and discrepancies.
8. Challenge — give the subject an opportunity to explain contradictions.
9. Admission questions, if justified — use only when the evidence and circumstances warrant them.
10. Closing — identify additional evidence, witnesses, explanations, and corrections.
11. Corroboration — independently test the statements against financial and other evidence.

The central principle is "follow the facts, not your theory." A forensic accountant's greatest advantage is the ability to connect a person's narrative to objective evidence—bank transactions, ledger entries, system metadata, invoices, communications, and other records. The interview should help you understand those records and generate new investigative leads, rather than substitute for documentary proof.

acfe.com is a particularly useful professional resource for developing these skills.

unless independent evidence establishes the latter.

Also preserve relevant exhibits, timestamps, notes, recordings where legally permissible, and any written statement.

A practical interview structure

For a suspected financial fraud, I'd use this sequence:

1. Preparation — understand the transactions and evidence.
2. Introduction/rapport — establish purpose and neutral baseline.
3. Free narrative — "Tell me what happened."
4. Process questions — establish how the accounting process normally works.
5. Specific transaction questions — who, what, when, where, how.
6. Clarification — define ambiguous terms and resolve vague answers.
7. Evidence testing — introduce relevant documents and discrepancies.
8. Challenge — give the subject an opportunity to explain contradictions.
9. Admission questions, if justified — use only when the evidence and circumstances warrant them.
10. Closing — identify additional evidence, witnesses, explanations, and corrections.
11. Corroboration — independently test the statements against financial and other evidence.

The central principle is "follow the facts, not your theory." A forensic accountant's greatest advantage is the ability to connect a person's narrative to objective evidence—bank transactions, ledger entries, system metadata, invoices, communications, and other records. The interview should help you understand those records and generate new investigative leads, rather than substitute for documentary proof.

acfe.com is a particularly useful professional resource for developing these skills.

"Is there anything you would like to correct or add to your answers?" ACFE specifically identifies closing questions as an opportunity to reconfirm facts, uncover previously undiscovered information, and identify additional evidence.

13. Document the interview meticulously

The interview record should distinguish:

Instead, treat behavioral changes as prompts for additional questions:

"I noticed you've become hesitant when we got to this transaction. Is there something about it you'd like to clarify?" ACFE's current interviewing material also cautions investigators to recognize their own biases and avoid drawing conclusions from nonverbal behavior without exploring the reason for it.

9. Maintain strategic silence

After asking an important question, stop talking.

For example:

"Did you transfer the $40,000 to that account?" Then wait.

Investigators sometimes become uncomfortable with silence and start explaining or modifying their question. That can give the interviewee an escape route.

A calm pause often encourages the person to elaborate voluntarily.

10. Ask the subject to explain the evidence

Some of the most useful questions for a forensic accountant are simple:

• "Explain this transaction."
• "Why was this entry made?"
• "Who instructed you to make it?"
• "Why was the entry posted on that date?"
• "Why does the supporting document say something different?"
• "Who had access to this account?"
• "How would someone have been able to make this change?"
• "What legitimate business purpose did this payment have?"
• "What records would prove your explanation?"

The last question is especially useful because it turns the interview into a roadmap for corroboration.

11. Work from neutral witnesses toward subjects

Don't necessarily interview the suspected perpetrator first.

A useful sequence is:

documents/data → neutral witnesses → knowledgeable witnesses → potentially involved employees → primary suspect

ACFE describes fraud examinations as moving from individuals least likely to be involved toward those more likely to be involved, allowing the investigator to develop information before conducting more difficult interviews.

Conducting an investigative interview in forensic accounting requires a unique blend of financial acumen and psychological insight. Unlike regular audits, these interviews often involve uncooperative, defensive, or dishonest subjects.

Top Techniques for Forensic Accounting Interviews

• The Cognitive Interviewing Technique : Focuses on memory enhancement by asking the subject to recall events from different chronological perspectives or sensory contexts, making it harder for a fabricator to maintain a consistent lie.
• The "Innocent" Opening Strategy : Start with non-threatening, routine background questions to establish a baseline for the subject's normal behavior, speech patterns, and stress responses before introducing sensitive financial topics.
• Open-Ended vs. Closed-Ended Sequencing : Begin with broad, open-ended questions ("Can you walk me through the approval workflow for these vendor invoices?" ) to let the subject incriminate themselves or lock into a story, reserving closed or direct questions for pinned-down contradictions later.
• Document Confrontation (The Silent Witness) : Introduce damaging physical evidence—such as a signed altered check or conflicting email—quietly and without immediate aggression, allowing the physical proof to exert psychological pressure rather than a raised voice.
• Behavioral Observation Analysis : Monitor baseline shifts in verbal and non-verbal cues (sudden changes in posture, grooming gestures, or defensive phrasing) not as proof of lying, but as markers indicating areas requiring deeper financial probing.

Practitioner Insights

I always find it helpful to let the interviewee talk rather than interrupting; silence is a powerful tool to encourage them to keep filling the void.

Would you like me to expand on how to structure the interview phases or provide tips on dealing with hostile or defensive subjects?

For a forensic accountant, an investigative interview is best treated as a fact-finding exercise supported by financial evidence, rather than simply an attempt to obtain a confession. The strongest approach combines careful preparation, rapport, structured questioning, and disciplined testing of the interviewee's account. The ACFE specifically emphasizes that effective interviewing can make or break a fraud examination.

1. Prepare the evidence before the interview

Know the financial story before you sit down with the interviewee.

• Build a chronology of relevant transactions, events, approvals, and communications.
• Identify the who, what, when, where, how, and why for each suspicious transaction.
• Reconcile relevant accounts and identify unexplained differences.
• Review invoices, journal entries, bank records, expense reports, emails, system logs, contracts, and supporting documentation.
• Identify what you know, what you suspect, and what you still need to establish.
• Prepare an interview plan, but don't become so attached to it that you ignore information emerging during the interview.

The ACFE recommends using facts and evidence gathered beforehand to construct questions and specifically warns against contaminating the interview with premature assumptions or interviewer bias.

2. Start broad, then become progressively specific

A useful progression is:

Open → clarify → narrow → test → challenge → close.

For example:

"Walk me through the process for approving vendor payments." Then:

"Who normally prepared the payment?" Then:

"Who approved this particular payment?" Then:

"What documentation did you review before approving it?" Finally:

"The invoice indicates X, but the accounting records indicate Y. Help me understand the difference." Open questions encourage the interviewee to provide information in their own words before you introduce the facts you already know. ACFE guidance similarly distinguishes introductory, informational, assessment, closing, and admission-seeking questions and recommends moving from general information toward more specific questioning.

3. Use the "tell me what happened" technique

Instead of immediately presenting your theory, ask the person to provide their own account.

Examples:

• "Tell me what happened."
• "Walk me through that transaction from beginning to end."
• "Describe your involvement."
• "What happened next?"
• "Who else was involved?"
• "What records would document that?"

Then listen.

Don't fill every silence. Don't interrupt unnecessarily. A person's initial narrative often gives you additional people, dates, documents, accounts, and transactions to investigate.

4. Ask precise follow-up questions

Financial investigations depend heavily on precision.

If someone says:

"I approved the payment because everything looked right." Don't move on.

Ask:

• "What specifically did you review?"
• "Which document did you look at?"
• "When did you review it?"
• "Who provided it to you?"
• "What did you understand the payment to be for?"
• "What does 'looked right' mean to you?"
• "What procedure were you following?"

This is particularly important with ambiguous words such as approved, authorized, reviewed, processed, normal, mistake, or personal use. ACFE's recent guidance recommends ensuring that the interviewer and interviewee share the same meaning of important terms rather than allowing ambiguity to undermine the answer.

5. Separate facts from conclusions

A common mistake is asking:

"Why did you commit fraud?" That assumes the conclusion.

Instead, establish the underlying facts:

"Did you create this vendor?" "What information did you use to create it?" "Who provided the bank-account information?" "Did you have access to that account?" "When did you first learn that the payments were being made?" Once the factual foundation is established, you can address intent or responsibility.

6. Use the accounting records as a roadmap

This is where a forensic accountant has a major advantage.

Rather than simply asking general questions, walk through the financial trail.

For example:

1. "You entered this journal entry on March 12, correct?"
2. "What caused you to make the entry?"
3. "Who requested it?"
4. "What supporting document did you rely on?"
5. "Why was account 6100 debited?"
6. "Why was account 1200 credited?"
7. "Where is the supporting documentation?"
8. "Who reviewed the entry?"
9. "Was anything unusual about this transaction?"

You are effectively asking the interviewee to explain the accounting evidence in their own words.

7. Don't reveal all your evidence too early

If you immediately tell someone everything you know, you may lose valuable investigative information.

For example, rather than opening with:

"We know you transferred $75,000 to ABC Consulting on June 14." you might first ask:

"Tell me about your relationship with ABC Consulting." Then:

"Who at the company did you deal with?" Then:

"What payments did you have involvement with?" Only later might you introduce the specific transaction and supporting evidence.

This approach can help you distinguish between what the person independently knows and what they may simply be incorporating from information you've supplied.

8. Test explanations against independent evidence

A good interview doesn't end when you receive an explanation.

For every significant explanation, ask:

"What evidence should exist if this explanation is true?"

For example, if an employee says:

"The CFO told me to make the transfer." Follow up with:

• Was there an email?
• Was there a phone call?
• Was there an approval?
• Who else knew about it?
• What documentation normally accompanies such an instruction?
• Did the employee follow the usual procedure?

Then independently verify those claims.

The interview is therefore one component of the investigation—not a substitute for documentary evidence.

9. Pay attention to inconsistencies—but don't equate nervousness with deception

Changes in answers, unexplained gaps, contradictions, unusually vague descriptions, or inability to explain transactions can be useful investigative leads.

But be cautious about body language. Nervousness, avoiding eye contact, changes in tone, or fidgeting are not reliable proof of deception. A person can be nervous because they are being interviewed, even when innocent.

ACFE materials discuss evaluating verbal and nonverbal responses, but the strongest practice is to use behavioral observations as prompts for additional fact-finding rather than as proof of guilt.

10. Use contradiction strategically

When the interviewee's account conflicts with the records, don't necessarily confront them immediately.

A useful sequence is:

Their account → clarification → documentary evidence → explanation.

For example:

"You said you didn't have access to the vendor master file. Can you explain how changes to vendor information were normally made?" Then:

"Who had access?" Then:

"I'm showing you the system log for April 8. It records your user ID making this change. Help me understand what happened." This gives the interviewee an opportunity to explain the discrepancy rather than simply announcing that you believe they're lying.

The PEACE investigative-interview model likewise emphasizes obtaining reliable facts, allowing accounts to be developed, and then addressing contradictions or evidence without relying on threats or intimidation.

11. Ask direct questions when the evidence warrants it

Once the evidence has been sufficiently developed, don't hide behind vague questions.

Instead of:

"Would you say you had anything to do with the transaction?" ask:

"Did you authorize this payment?" or:

"Did you create the false invoice?" or:

"Did you transfer company funds to your personal account?" ACFE guidance specifically recommends precise, direct questions and cautions against formulations such as "What would you say if..." that allow a subject to answer hypothetically rather than address the underlying fact.

12. End by giving the interviewee an opportunity to explain

Before closing, ask questions such as:

• "Is there anything I've misunderstood?"
• "Is there anything else you think I should know?"
• "Is there anyone else I should speak with?"
• "Are there documents or records that would help verify your explanation?"
• "Is there anything in the records we've discussed that you believe is incorrect?"

This can produce important information—and gives the interviewee a fair opportunity to provide an alternative explanation.

A practical framework

For most forensic-accounting interviews, I'd use this structure:

The overarching principle is: prepare more than you speak, ask more than you tell, and corroborate more than you assume.

For a forensic accountant, the most powerful interview is usually not the one in which you "catch" someone—it is the one that produces a detailed, internally consistent account that can be reconciled against the books, bank records, electronic evidence, and other witnesses.

Their account → clarification → documentary evidence → explanation.

For example:

"You said you didn't have access to the vendor master file. Can you explain how changes to vendor information were normally made?" Then:

"Who had access?" Then:

"I'm showing you the system log for April 8. It records your user ID making this change. Help me understand what happened." This gives the interviewee an opportunity to explain the discrepancy rather than simply announcing that you believe they're lying.

The PEACE investigative-interview model likewise emphasizes obtaining reliable facts, allowing accounts to be developed, and then addressing contradictions or evidence without relying on threats or intimidation.

11. Ask direct questions when the evidence warrants it

Once the evidence has been sufficiently developed, don't hide behind vague questions.

Instead of:

"Would you say you had anything to do with the transaction?" ask:

"Did you authorize this payment?" or:

"Did you create the false invoice?" or:

"Did you transfer company funds to your personal account?" ACFE guidance specifically recommends precise, direct questions and cautions against formulations such as "What would you say if..." that allow a subject to answer hypothetically rather than address the underlying fact.

12. End by giving the interviewee an opportunity to explain

Before closing, ask questions such as:

Then independently verify those claims.

The interview is therefore one component of the investigation—not a substitute for documentary evidence.

9. Pay attention to inconsistencies—but don't equate nervousness with deception

Changes in answers, unexplained gaps, contradictions, unusually vague descriptions, or inability to explain transactions can be useful investigative leads.

But be cautious about body language. Nervousness, avoiding eye contact, changes in tone, or fidgeting are not reliable proof of deception. A person can be nervous because they are being interviewed, even when innocent.

ACFE materials discuss evaluating verbal and nonverbal responses, but the strongest practice is to use behavioral observations as prompts for additional fact-finding rather than as proof of guilt.