In this guide
When a Count Becomes an Investigation
A forensic stock audit starts from a suspicion rather than from a schedule, and that single difference changes the method, the evidence standard and the output. A routine count asks whether the stock agrees with the books. A forensic examination asks how a specific difference came to exist, who had the access and the opportunity to create it, and what documentary trail was produced to conceal it. The evidence standard is higher because the findings may end up in front of somebody other than the finance team, so custody of documents is recorded, source records are preserved rather than summarised, and inferences are separated from observations on the page. What it can establish is what the records show, what the physical stock shows, and where the two cannot be reconciled by any innocent explanation the available documents support. What it cannot do is determine guilt, which is a matter for a forum with powers an auditor does not have.
How Inventory Fraud Is Usually Done
The methods are limited in number and well understood, which is what makes them findable. Fictitious stock and inflated quantities are the simplest: counts are recorded for goods that do not exist, or real quantities are overstated on the sheets, and the fabricated figure flows into the stock statement and the accounts. It survives because nobody independently recounts, and it is detected the first time somebody does. Stock counted twice across locations is the second method and it is harder to see from any single site. Goods are counted at one location, moved, and counted again at another, or the same goods are reported to two different lenders. Each individual count is accurate; only a simultaneous count across sites, or a reconciliation of transit movements, exposes it. Goods removed and covered by adjustments is the third and it leaves the most trace. Stock genuinely leaves and the shortfall is absorbed through write-offs, damage claims, scrap entries or process-loss allowances set generously enough to swallow it. The signature is not the individual entry, which is always plausible, but the pattern: adjustments running consistently in one direction, or a loss allowance that never varies with the process.
What Separates Forensic From Routine
Three things distinguish forensic work, and the first is surprise combined with simultaneity. A routine count is scheduled; a forensic count arrives without notice, and where several locations are implicated they are counted at the same moment, because sequential counting is exactly the weakness that double-counting exploits. Coordinating that is the main logistical difference. Evidence chain and its preservation is the second. On routine work, source records are summarised into working papers and the originals stay with the client. On forensic work the records themselves may become evidence, so what is collected is documented at the point of collection, with who obtained it, from whom and when, and originals are preserved rather than returned. Working papers that would satisfy a routine review are frequently inadequate if the findings are later contested. Interviews alongside counting is the third. Routine work asks operational questions of whoever is available; forensic work asks structured questions of specific people, records what was said, and separates what a person asserted from what the records show. Those two are never merged in the report, because the value of the exercise depends on the reader being able to tell them apart.
Building an Evidence Chain
An evidence chain is what allows a finding to survive somebody with an interest in destroying it, and it is built at the time rather than assembled afterwards. Documenting custody means recording, for each item collected, what it is, where it came from, who handed it over, when, and who has held it since. A ledger that cannot show an unbroken line from the source to the examiner invites the argument that it was altered in between, and that argument does not need to be true to be effective. Photographic and system evidence needs the same discipline. Photographs are recorded with their time and location and are not edited; system extracts are taken by somebody independent of the area under examination, with the query and the extraction time recorded, so that a later extract can be compared against the first. Extracts taken casually by the department concerned are worth very little. What has to survive a challenge determines all of it. The realistic challenges are that the evidence was fabricated, altered, or is not what it claims to be, and each is answered by the chain rather than by the examiner's assurance.
What the Findings Can Support
A forensic examination produces findings that have to survive being disputed by somebody with an interest in disputing them, which shapes what it can and cannot support. Quantifying a loss is done within defensible bounds rather than as a single confident figure. The examination establishes a range supported by the records that exist, states the assumptions behind each end of it, and identifies what further evidence would narrow it. A precise number resting on an assumption nobody has tested is easier to attack than a range that shows its working. Those findings support insurance and recovery claims, where the insurer will apply its own scrutiny to both the quantum and the causation, and a claim built on documented reconciliation survives that scrutiny far better than one built on an assertion of loss. The report stops at a definite boundary. It sets out what the records show, what the physical position showed, where the two cannot be reconciled innocently, and who had the access and opportunity the records disclose. Whether that amounts to an offence, and who is answerable for it, is decided elsewhere.
Commissioning a Forensic Count
Acting without alerting the subject is the first constraint, and it shapes everything about how the engagement is set up. Requests for records go through people outside the area under examination. System extracts are taken by whoever administers the system rather than by whoever uses it. Any physical count is arranged as something ordinary or is not announced at all. An examination that begins with a general request for documents from the department concerned has usually lost most of what it was looking for before anybody arrives. Keep the circle small and deliberate. Whoever authorises the work, one person able to obtain records without explanation, and the examiners is generally enough, and each addition increases the risk of disclosure without improving the work. Legal advice on how findings may be used is worth taking early rather than after the report exists. Bring in an independent firm immediately where the suspicion involves anyone able to influence the records, where the amount is material, or where an insurance claim or recovery action may follow, since evidence gathered informally first rarely survives later scrutiny. Stock audit work in this mode is scoped very differently from a routine cycle.
